<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
<link href="common/css/sf.css" rel="stylesheet" type="text/css"/>
<title>Hoare: Hoare Logic, Part I</title>
</head>
<link href="common/jquery-ui/jquery-ui.css" rel="stylesheet">
<script src="common/jquery-ui/external/jquery/jquery.js"></script>
<script src="common/jquery-ui/jquery-ui.js"></script>
<script src="common/toggleproofs.js"></script>
<link href="common/css/plf.css" rel="stylesheet" type="text/css"/>

<body>

<div id="page">

<div id="header">
<a href='https://www.cis.upenn.edu/~bcpierce/sf/current/index.html'>
<img src='common/media/image/sf_logo_sm.png'></a>
</br><a href='index.html'>  <span class='booktitleinheader'>Volume 2: Programming Language Foundations</span><br></br>
<ul id='menu'>
   <a href='toc.html'><li class='section_name'>Table of Contents</li></a>
   <a href='coqindex.html'><li class='section_name'>Index</li></a>
   <a href='deps.html'><li class='section_name'>Roadmap</li></a>
</ul>
</a></div>

<div id="main">

<h1 class="libtitle">Hoare<span class="subtitle">Hoare Logic, Part I</span></h1>


<div class="code code-tight">

<span class="id" type="keyword">Set</span> <span class="id" type="var">Warnings</span> "-notation-overridden,-parsing".<br/>
<span class="id" type="var">From</span> <span class="id" type="var">PLF</span> <span class="id" type="keyword">Require</span> <span class="id" type="keyword">Import</span> <span class="id" type="var">Maps</span>.<br/>
<span class="id" type="var">From</span> <span class="id" type="var">Coq</span> <span class="id" type="keyword">Require</span> <span class="id" type="keyword">Import</span> <span class="id" type="var">Bool.Bool</span>.<br/>
<span class="id" type="var">From</span> <span class="id" type="var">Coq</span> <span class="id" type="keyword">Require</span> <span class="id" type="keyword">Import</span> <span class="id" type="var">Arith.Arith</span>.<br/>
<span class="id" type="var">From</span> <span class="id" type="var">Coq</span> <span class="id" type="keyword">Require</span> <span class="id" type="keyword">Import</span> <span class="id" type="var">Arith.EqNat</span>.<br/>
<span class="id" type="var">From</span> <span class="id" type="var">Coq</span> <span class="id" type="keyword">Require</span> <span class="id" type="keyword">Import</span> <span class="id" type="var">Arith.PeanoNat</span>. <span class="id" type="keyword">Import</span> <span class="id" type="var">Nat</span>.<br/>
<span class="id" type="var">From</span> <span class="id" type="var">Coq</span> <span class="id" type="keyword">Require</span> <span class="id" type="keyword">Import</span> <span class="id" type="var">omega.Omega</span>.<br/>
<span class="id" type="var">From</span> <span class="id" type="var">PLF</span> <span class="id" type="keyword">Require</span> <span class="id" type="keyword">Import</span> <span class="id" type="var">Imp</span>.<br/>
</div>

<div class="doc">
In the final chaper of <i>Logical Foundations</i> (<i>Software
    Foundations</i>, volume 1), we began applying the mathematical tools
    developed in the first part of the course to studying the theory
    of a small programming language, Imp.

<div class="paragraph"> </div>

<ul class="doclist">
<li> We defined a type of <i>abstract syntax trees</i> for Imp, together
      with an <i>evaluation relation</i> (a partial function on states)
      that specifies the <i>operational semantics</i> of programs.

<div class="paragraph"> </div>

      The language we defined, though small, captures some of the key
      features of full-blown languages like C, C++, and Java,
      including the fundamental notion of mutable state and some
      common control structures.

<div class="paragraph"> </div>


</li>
<li> We proved a number of <i>metatheoretic properties</i> &mdash; "meta" in
      the sense that they are properties of the language as a whole,
      rather than of particular programs in the language.  These
      included:

<div class="paragraph"> </div>

<ul class="doclist">
<li> determinism of evaluation

<div class="paragraph"> </div>


</li>
<li> equivalence of some different ways of writing down the
          definitions (e.g., functional and relational definitions of
          arithmetic expression evaluation)

<div class="paragraph"> </div>


</li>
<li> guaranteed termination of certain classes of programs

<div class="paragraph"> </div>


</li>
<li> correctness (in the sense of preserving meaning) of a number
          of useful program transformations

<div class="paragraph"> </div>


</li>
<li> behavioral equivalence of programs (in the <a href="Equiv.html"><span class="inlineref">Equiv</span></a>
          chapter). 
</li>
</ul>

</li>
</ul>

<div class="paragraph"> </div>

 If we stopped here, we would already have something useful: a set
    of tools for defining and discussing programming languages and
    language features that are mathematically precise, flexible, and
    easy to work with, applied to a set of key properties.  All of
    these properties are things that language designers, compiler
    writers, and users might care about knowing.  Indeed, many of them
    are so fundamental to our understanding of the programming
    languages we deal with that we might not consciously recognize
    them as "theorems."  But properties that seem intuitively obvious
    can sometimes be quite subtle (sometimes also subtly wrong!).

<div class="paragraph"> </div>

    We'll return to the theme of metatheoretic properties of whole
    languages later in this volume when we discuss <i>types</i> and <i>type
    soundness</i>.  In this chapter, though, we turn to a different set
    of issues.

<div class="paragraph"> </div>

    Our goal is to carry out some simple examples of <i>program
    verification</i> &mdash; i.e., to use the precise definition of Imp to
    prove formally that particular programs satisfy particular
    specifications of their behavior.  We'll develop a reasoning
    system called <i>Floyd-Hoare Logic</i> &mdash; often shortened to just
    <i>Hoare Logic</i> &mdash; in which each of the syntactic constructs of Imp
    is equipped with a generic "proof rule" that can be used to reason
    compositionally about the correctness of programs involving this
    construct.

<div class="paragraph"> </div>

    Hoare Logic originated in the 1960s, and it continues to be the
    subject of intensive research right up to the present day.  It
    lies at the core of a multitude of tools that are being used in
    academia and industry to specify and verify real software systems.

<div class="paragraph"> </div>

    Hoare Logic combines two beautiful ideas: a natural way of writing
    down <i>specifications</i> of programs, and a <i>compositional proof
    technique</i> for proving that programs are correct with respect to
    such specifications &mdash; where by "compositional" we mean that the
    structure of proofs directly mirrors the structure of the programs
    that they are about. 
<div class="paragraph"> </div>

 Overview of this chapter...

<div class="paragraph"> </div>

    Topic:      

<div class="paragraph"> </div>

<ul class="doclist">
<li> A systematic method for reasoning about the <i>functional
        correctness</i> of programs in Imp

</li>
</ul>

<div class="paragraph"> </div>

    Goals:

<div class="paragraph"> </div>

<ul class="doclist">
<li> a natural notation for <i>program specifications</i> and

</li>
<li> a <i>compositional</i> proof technique for program correctness

</li>
</ul>

<div class="paragraph"> </div>

    Plan:

<div class="paragraph"> </div>

<ul class="doclist">
<li> specifications (assertions / Hoare triples)

</li>
<li> proof rules

</li>
<li> loop invariants

</li>
<li> decorated programs

</li>
<li> examples 
</li>
</ul>

</div>

<div class="doc">
<a name="lab49"></a><h1 class="section">Assertions</h1>

<div class="paragraph"> </div>

 To talk about specifications of programs, the first thing we
    need is a way of making <i>assertions</i> about properties that hold at
    particular points during a program's execution &mdash; i.e., claims
    about the current state of the memory when execution reaches that
    point.  Formally, an assertion is just a family of propositions
    indexed by a <span class="inlinecode"><span class="id" type="var">state</span></span>. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">Assertion</span> := <span class="id" type="var">state</span> → <span class="id" type="keyword">Prop</span>.<br/>
</div>

<div class="doc">
<a name="lab50"></a><h4 class="section">Exercise: 1 star, standard, optional (assertions)</h4>
 Paraphrase the following assertions in English (or your favorite
    natural language). 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Module</span> <span class="id" type="var">ExAssertions</span>.<br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">as<sub>1</sub></span> : <span class="id" type="var">Assertion</span> := <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = 3.<br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">as<sub>2</sub></span> : <span class="id" type="var">Assertion</span> := <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">Y</span>.<br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">as<sub>3</sub></span> : <span class="id" type="var">Assertion</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = 3 ∨ <span class="id" type="var">st</span> <span class="id" type="var">X</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">Y</span>.<br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">as<sub>4</sub></span> : <span class="id" type="var">Assertion</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Z</span> * <span class="id" type="var">st</span> <span class="id" type="var">Z</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span> ∧<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;¬(((<span class="id" type="var">S</span> (<span class="id" type="var">st</span> <span class="id" type="var">Z</span>)) * (<span class="id" type="var">S</span> (<span class="id" type="var">st</span> <span class="id" type="var">Z</span>))) ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span>).<br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">as<sub>5</sub></span> : <span class="id" type="var">Assertion</span> := <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span>.<br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">as<sub>6</sub></span> : <span class="id" type="var">Assertion</span> := <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">False</span>.<br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
<span class="id" type="keyword">End</span> <span class="id" type="var">ExAssertions</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

 This way of writing assertions can be a little bit heavy,
    for two reasons: (1) every single assertion that we ever write is
    going to begin with <span class="inlinecode"><span class="id" type="keyword">fun</span></span> <span class="inlinecode"><span class="id" type="var">st</span></span> <span class="inlinecode">⇒</span> <span class="inlinecode"></span>; and (2) this state <span class="inlinecode"><span class="id" type="var">st</span></span> is the
    only one that we ever use to look up variables in assertions (we
    will never need to talk about two different memory states at the
    same time).  For discussing examples informally, we'll adopt some
    simplifying conventions: we'll drop the initial <span class="inlinecode"><span class="id" type="keyword">fun</span></span> <span class="inlinecode"><span class="id" type="var">st</span></span> <span class="inlinecode">⇒</span>, and
    we'll write just <span class="inlinecode"><span class="id" type="var">X</span></span> to mean <span class="inlinecode"><span class="id" type="var">st</span></span> <span class="inlinecode"><span class="id" type="var">X</span></span>.  Thus, instead of writing 
<div class="paragraph"> </div>


<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;⇒&nbsp;(<span class="id" type="var">st</span>&nbsp;<span class="id" type="var">Z</span>)&nbsp;*&nbsp;(<span class="id" type="var">st</span>&nbsp;<span class="id" type="var">Z</span>)&nbsp;≤&nbsp;<span class="id" type="var">m</span>&nbsp;∧<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;¬((<span class="id" type="var">S</span>&nbsp;(<span class="id" type="var">st</span>&nbsp;<span class="id" type="var">Z</span>))&nbsp;*&nbsp;(<span class="id" type="var">S</span>&nbsp;(<span class="id" type="var">st</span>&nbsp;<span class="id" type="var">Z</span>))&nbsp;≤&nbsp;<span class="id" type="var">m</span>)
<div class="paragraph"> </div>

</div>
    we'll write just

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Z</span>&nbsp;*&nbsp;<span class="id" type="var">Z</span>&nbsp;≤&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;~((<span class="id" type="var">S</span>&nbsp;<span class="id" type="var">Z</span>)&nbsp;*&nbsp;(<span class="id" type="var">S</span>&nbsp;<span class="id" type="var">Z</span>)&nbsp;≤&nbsp;<span class="id" type="var">m</span>).
<div class="paragraph"> </div>

</div>

<div class="paragraph"> </div>

 This example also illustrates a convention that we'll use
    throughout the Hoare Logic chapters: in informal assertions,
    capital letters like <span class="inlinecode"><span class="id" type="var">X</span></span>, <span class="inlinecode"><span class="id" type="var">Y</span></span>, and <span class="inlinecode"><span class="id" type="var">Z</span></span> are Imp variables, while
    lowercase letters like <span class="inlinecode"><span class="id" type="var">x</span></span>, <span class="inlinecode"><span class="id" type="var">y</span></span>, <span class="inlinecode"><span class="id" type="var">m</span></span>, and <span class="inlinecode"><span class="id" type="var">n</span></span> are ordinary Coq
    variables (of type <span class="inlinecode"><span class="id" type="var">nat</span></span>).  This is why, when translating from
    informal to formal, we replace <span class="inlinecode"><span class="id" type="var">X</span></span> with <span class="inlinecode"><span class="id" type="var">st</span></span> <span class="inlinecode"><span class="id" type="var">X</span></span> but leave <span class="inlinecode"><span class="id" type="var">m</span></span>
    alone. 
<div class="paragraph"> </div>

 Given two assertions <span class="inlinecode"><span class="id" type="var">P</span></span> and <span class="inlinecode"><span class="id" type="var">Q</span></span>, we say that <span class="inlinecode"><span class="id" type="var">P</span></span> <i>implies</i> <span class="inlinecode"><span class="id" type="var">Q</span></span>,
    written <span class="inlinecode"><span class="id" type="var">P</span></span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span> <span class="inlinecode"><span class="id" type="var">Q</span></span>, if, whenever <span class="inlinecode"><span class="id" type="var">P</span></span> holds in some state <span class="inlinecode"><span class="id" type="var">st</span></span>, <span class="inlinecode"><span class="id" type="var">Q</span></span>
    also holds. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">assert_implies</span> (<span class="id" type="var">P</span> <span class="id" type="var">Q</span> : <span class="id" type="var">Assertion</span>) : <span class="id" type="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span>, <span class="id" type="var">P</span> <span class="id" type="var">st</span> → <span class="id" type="var">Q</span> <span class="id" type="var">st</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Notation</span> "P <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> Q" := (<span class="id" type="var">assert_implies</span> <span class="id" type="var">P</span> <span class="id" type="var">Q</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80) : <span class="id" type="var">hoare_spec_scope</span>.<br/>
<span class="id" type="keyword">Open</span> <span class="id" type="keyword">Scope</span> <span class="id" type="var">hoare_spec_scope</span>.<br/>
</div>

<div class="doc">
(The <span class="inlinecode"><span class="id" type="var">hoare_spec_scope</span></span> annotation here tells Coq that this
    notation is not global but is intended to be used in particular
    contexts.  The <span class="inlinecode"><span class="id" type="keyword">Open</span></span> <span class="inlinecode"><span class="id" type="keyword">Scope</span></span> tells Coq that this file is one such
    context.) 
<div class="paragraph"> </div>

 We'll also want the "iff" variant of implication between
    assertions: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Notation</span> "P <span class="nowrap"><span style='font-size:85%;'><span style='letter-spacing:-.2em;'><<</span><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> Q" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">P</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">Q</span> ∧ <span class="id" type="var">Q</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">P</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80) : <span class="id" type="var">hoare_spec_scope</span>.<br/>
</div>

<div class="doc">
<a name="lab51"></a><h1 class="section">Hoare Triples</h1>

<div class="paragraph"> </div>

 Next, we need a way of making formal claims about the
    behavior of commands. 
<div class="paragraph"> </div>

 In general, the behavior of a command is to transform one state to
    another, so it is natural to express claims about commands in
    terms of assertions that are true before and after the command
    executes:

<div class="paragraph"> </div>

<ul class="doclist">
<li> "If command <span class="inlinecode"><span class="id" type="var">c</span></span> is started in a state satisfying assertion
        <span class="inlinecode"><span class="id" type="var">P</span></span>, and if <span class="inlinecode"><span class="id" type="var">c</span></span> eventually terminates in some final state,
        then this final state will satisfy the assertion <span class="inlinecode"><span class="id" type="var">Q</span></span>."

</li>
</ul>

<div class="paragraph"> </div>

    Such a claim is called a <i>Hoare Triple</i>.  The assertion <span class="inlinecode"><span class="id" type="var">P</span></span> is
    called the <i>precondition</i> of <span class="inlinecode"><span class="id" type="var">c</span></span>, while <span class="inlinecode"><span class="id" type="var">Q</span></span> is the
    <i>postcondition</i>.  
<div class="paragraph"> </div>

 Formally: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">hoare_triple</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">P</span> : <span class="id" type="var">Assertion</span>) (<span class="id" type="var">c</span> : <span class="id" type="var">com</span>) (<span class="id" type="var">Q</span> : <span class="id" type="var">Assertion</span>) : <span class="id" type="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">st'</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">c</span> ]⇒ <span class="id" type="var">st'</span>  →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">P</span> <span class="id" type="var">st</span>  →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Q</span> <span class="id" type="var">st'</span>.<br/>
</div>

<div class="doc">
Since we'll be working a lot with Hoare triples, it's useful to
    have a compact notation:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">c</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}.
<div class="paragraph"> </div>

</div>
 (The traditional notation is <span class="inlinecode">{<span class="id" type="var">P</span>}</span> <span class="inlinecode"><span class="id" type="var">c</span></span> <span class="inlinecode">{<span class="id" type="var">Q</span>}</span>, but single braces
    are already used for other things in Coq.)  
</div>
<div class="code code-tight">

<span class="id" type="keyword">Notation</span> "<span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}  c  <span style='letter-spacing:-.4em;'>{</span>{ Q <span style='letter-spacing:-.4em;'>}</span>}" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">hoare_triple</span> <span class="id" type="var">P</span> <span class="id" type="var">c</span> <span class="id" type="var">Q</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 90, <span class="id" type="var">c</span> <span class="id" type="tactic">at</span> <span class="id" type="var">next</span> <span class="id" type="var">level</span>)<br/>
&nbsp;&nbsp;: <span class="id" type="var">hoare_spec_scope</span>.<br/>
</div>

<div class="doc">
<a name="lab52"></a><h4 class="section">Exercise: 1 star, standard, optional (triples)</h4>
 Paraphrase the following Hoare triples in English.

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;1)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">c</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;5<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;2)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">c</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span>&nbsp;+&nbsp;5)<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;3)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;≤&nbsp;<span class="id" type="var">Y</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">c</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Y</span>&nbsp;≤&nbsp;<span class="id" type="var">X</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;4)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">c</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">False</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;5)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">c</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">real_fact</span>&nbsp;<span class="id" type="var">m</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;&nbsp;<br/>
<br/>
&nbsp;&nbsp;&nbsp;6)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">m</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">c</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{(<span class="id" type="var">Z</span>&nbsp;*&nbsp;<span class="id" type="var">Z</span>)&nbsp;≤&nbsp;<span class="id" type="var">m</span>&nbsp;∧&nbsp;¬(((<span class="id" type="var">S</span>&nbsp;<span class="id" type="var">Z</span>)&nbsp;*&nbsp;(<span class="id" type="var">S</span>&nbsp;<span class="id" type="var">Z</span>))&nbsp;≤&nbsp;<span class="id" type="var">m</span>)<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

</div>
<div class="code code-tight">
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

<a name="lab53"></a><h4 class="section">Exercise: 1 star, standard, optional (valid_triples)</h4>
 Which of the following Hoare triples are <i>valid</i> &mdash; i.e., the
    claimed relation between <span class="inlinecode"><span class="id" type="var">P</span></span>, <span class="inlinecode"><span class="id" type="var">c</span></span>, and <span class="inlinecode"><span class="id" type="var">Q</span></span> is true?

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;1)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;5<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;2)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;2<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;1&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;3<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;3)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;5;;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;5<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;4)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;2&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;3<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;0<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;5)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">SKIP</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">False</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;6)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">False</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">SKIP</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;7)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">WHILE</span>&nbsp;<span class="id" type="var">true</span>&nbsp;<span class="id" type="var">DO</span>&nbsp;<span class="id" type="var">SKIP</span>&nbsp;<span class="id" type="var">END</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">False</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;8)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;0<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;0&nbsp;<span class="id" type="var">DO</span>&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;1&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;1<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;9)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;1<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;~(<span class="id" type="var">X</span>&nbsp;=&nbsp;0)&nbsp;<span class="id" type="var">DO</span>&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;1&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;100<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

</div>
<div class="code code-tight">
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

 To get us warmed up for what's coming, here are two simple facts
    about Hoare triples.  (Make sure you understand what they mean.) 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_post_true</span> : <span style='font-size:120%;'>&forall;</span>(<span class="id" type="var">P</span> <span class="id" type="var">Q</span> : <span class="id" type="var">Assertion</span>) <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;(<span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span>, <span class="id" type="var">Q</span> <span class="id" type="var">st</span>) →<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<div class="togglescript" id="proofcontrol1" onclick="toggleDisplay('proof1');toggleDisplay('proofcontrol1')"><span class="show"></span></div>
<div class="proofscript" id="proof1" onclick="toggleDisplay('proof1');toggleDisplay('proofcontrol1')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">c</span> <span class="id" type="var">H</span>. <span class="id" type="tactic">unfold</span> <span class="id" type="var">hoare_triple</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">Heval</span> <span class="id" type="var">HP</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">H</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>

<br/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_pre_false</span> : <span style='font-size:120%;'>&forall;</span>(<span class="id" type="var">P</span> <span class="id" type="var">Q</span> : <span class="id" type="var">Assertion</span>) <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;(<span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span>, ¬(<span class="id" type="var">P</span> <span class="id" type="var">st</span>)) →<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<div class="togglescript" id="proofcontrol2" onclick="toggleDisplay('proof2');toggleDisplay('proofcontrol2')"><span class="show"></span></div>
<div class="proofscript" id="proof2" onclick="toggleDisplay('proof2');toggleDisplay('proofcontrol2')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">c</span> <span class="id" type="var">H</span>. <span class="id" type="tactic">unfold</span> <span class="id" type="var">hoare_triple</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">Heval</span> <span class="id" type="var">HP</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">not</span> <span class="id" type="keyword">in</span> <span class="id" type="var">H</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">H</span> <span class="id" type="keyword">in</span> <span class="id" type="var">HP</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">inversion</span> <span class="id" type="var">HP</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
<a name="lab54"></a><h1 class="section">Proof Rules</h1>

<div class="paragraph"> </div>

 The goal of Hoare logic is to provide a <i>compositional</i>
    method for proving the validity of specific Hoare triples.  That
    is, we want the structure of a program's correctness proof to
    mirror the structure of the program itself.  To this end, in the
    sections below, we'll introduce a rule for reasoning about each of
    the different syntactic forms of commands in Imp &mdash; one for
    assignment, one for sequencing, one for conditionals, etc. &mdash; plus
    a couple of "structural" rules for gluing things together.  We
    will then be able to prove programs correct using these proof
    rules, without ever unfolding the definition of <span class="inlinecode"><span class="id" type="var">hoare_triple</span></span>. 
</div>

<div class="doc">
<a name="lab55"></a><h2 class="section">Assignment</h2>

<div class="paragraph"> </div>

 The rule for assignment is the most fundamental of the Hoare logic
    proof rules.  Here's how it works.

<div class="paragraph"> </div>

    Consider this valid Hoare triple:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;1&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;1&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    In English: if we start out in a state where the value of <span class="inlinecode"><span class="id" type="var">Y</span></span>
    is <span class="inlinecode">1</span> and we assign <span class="inlinecode"><span class="id" type="var">Y</span></span> to <span class="inlinecode"><span class="id" type="var">X</span></span>, then we'll finish in a
    state where <span class="inlinecode"><span class="id" type="var">X</span></span> is <span class="inlinecode">1</span>. 
    That is, the property of being equal to <span class="inlinecode">1</span> gets transferred
    from <span class="inlinecode"><span class="id" type="var">Y</span></span> to <span class="inlinecode"><span class="id" type="var">X</span></span>. 
<div class="paragraph"> </div>

 Similarly, in

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;<span class="id" type="var">Z</span>&nbsp;=&nbsp;1&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;+&nbsp;<span class="id" type="var">Z</span>&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;1&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    the same property (being equal to one) gets transferred to
    <span class="inlinecode"><span class="id" type="var">X</span></span> from the expression <span class="inlinecode"><span class="id" type="var">Y</span></span> <span class="inlinecode">+</span> <span class="inlinecode"><span class="id" type="var">Z</span></span> on the right-hand side of
    the assignment. 
<div class="paragraph"> </div>

 More generally, if <span class="inlinecode"><span class="id" type="var">a</span></span> is <i>any</i> arithmetic expression, then

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">a</span>&nbsp;=&nbsp;1&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">a</span>&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;1&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    is a valid Hoare triple. 
<div class="paragraph"> </div>

 Even more generally, to conclude that an arbitrary assertion <span class="inlinecode"><span class="id" type="var">Q</span></span>
    holds after <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span></span> <span class="inlinecode"><span class="id" type="var">a</span></span>, we need to assume that <span class="inlinecode"><span class="id" type="var">Q</span></span> holds before <span class="inlinecode"><span class="id" type="var">X</span></span>
    <span class="inlinecode"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span></span> <span class="inlinecode"><span class="id" type="var">a</span></span>, but <i>with all occurrences of</i> <span class="inlinecode"><span class="id" type="var">X</span></span> replaced by <span class="inlinecode"><span class="id" type="var">a</span></span> in
    <span class="inlinecode"><span class="id" type="var">Q</span></span>. This leads to the Hoare rule for assignment

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Q</span>&nbsp;[<span class="id" type="var">X</span>&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span>&nbsp;<span class="id" type="var">a</span>]&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">a</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">Q</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    where "<span class="inlinecode"><span class="id" type="var">Q</span></span> <span class="inlinecode">[<span class="id" type="var">X</span></span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span> <span class="inlinecode"><span class="id" type="var">a</span>]</span>" is pronounced "<span class="inlinecode"><span class="id" type="var">Q</span></span> where <span class="inlinecode"><span class="id" type="var">a</span></span> is substituted
    for <span class="inlinecode"><span class="id" type="var">X</span></span>". 
<div class="paragraph"> </div>

 For example, these are valid applications of the assignment
    rule:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;(<span class="id" type="var">X</span>&nbsp;≤&nbsp;5)&nbsp;[<span class="id" type="var">X</span>&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;1]<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">i.e</span>.,&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;1&nbsp;≤&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;(<span class="id" type="var">X</span>&nbsp;=&nbsp;3)&nbsp;[<span class="id" type="var">X</span>&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span>&nbsp;3]<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">i.e</span>.,&nbsp;3&nbsp;=&nbsp;3&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;3<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;3&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;(0&nbsp;≤&nbsp;<span class="id" type="var">X</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;5)&nbsp;[<span class="id" type="var">X</span>&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span>&nbsp;3]<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">i.e</span>.,&nbsp;(0&nbsp;≤&nbsp;3&nbsp;∧&nbsp;3&nbsp;≤&nbsp;5)&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;3<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;0&nbsp;≤&nbsp;<span class="id" type="var">X</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

<div class="paragraph"> </div>

 To formalize the rule, we must first formalize the idea of
    "substituting an expression for an Imp variable in an assertion",
    which we refer to as assertion substitution, or <span class="inlinecode"><span class="id" type="var">assn_sub</span></span>.  That
    is, given a proposition <span class="inlinecode"><span class="id" type="var">P</span></span>, a variable <span class="inlinecode"><span class="id" type="var">X</span></span>, and an arithmetic
    expression <span class="inlinecode"><span class="id" type="var">a</span></span>, we want to derive another proposition <span class="inlinecode"><span class="id" type="var">P'</span></span> that is
    just the same as <span class="inlinecode"><span class="id" type="var">P</span></span> except that <span class="inlinecode"><span class="id" type="var">P'</span></span> should mention <span class="inlinecode"><span class="id" type="var">a</span></span> wherever
    <span class="inlinecode"><span class="id" type="var">P</span></span> mentions <span class="inlinecode"><span class="id" type="var">X</span></span>. 
<div class="paragraph"> </div>

 Since <span class="inlinecode"><span class="id" type="var">P</span></span> is an arbitrary Coq assertion, we can't directly "edit"
    its text.  However, we can achieve the same effect by evaluating
    <span class="inlinecode"><span class="id" type="var">P</span></span> in an updated state: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">assn_sub</span> <span class="id" type="var">X</span> <span class="id" type="var">a</span> <span class="id" type="var">P</span> : <span class="id" type="var">Assertion</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="keyword">fun</span> (<span class="id" type="var">st</span> : <span class="id" type="var">state</span>) ⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">P</span> (<span class="id" type="var">X</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> <span class="id" type="var">aeval</span> <span class="id" type="var">st</span> <span class="id" type="var">a</span> ; <span class="id" type="var">st</span>).<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Notation</span> "P [ X <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> a ]" := (<span class="id" type="var">assn_sub</span> <span class="id" type="var">X</span> <span class="id" type="var">a</span> <span class="id" type="var">P</span>)<br/>
&nbsp;&nbsp;(<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 10, <span class="id" type="var">X</span> <span class="id" type="tactic">at</span> <span class="id" type="var">next</span> <span class="id" type="var">level</span>).<br/>
</div>

<div class="doc">
That is, <span class="inlinecode"><span class="id" type="var">P</span></span> <span class="inlinecode">[<span class="id" type="var">X</span></span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span> <span class="inlinecode"><span class="id" type="var">a</span>]</span> stands for an assertion &mdash; let's call it <span class="inlinecode"><span class="id" type="var">P'</span></span> &mdash;
    that is just like <span class="inlinecode"><span class="id" type="var">P</span></span> except that, wherever <span class="inlinecode"><span class="id" type="var">P</span></span> looks up the
    variable <span class="inlinecode"><span class="id" type="var">X</span></span> in the current state, <span class="inlinecode"><span class="id" type="var">P'</span></span> instead uses the value
    of the expression <span class="inlinecode"><span class="id" type="var">a</span></span>. 
<div class="paragraph"> </div>

 To see how this works, let's calculate what happens with a couple
    of examples.  First, suppose <span class="inlinecode"><span class="id" type="var">P'</span></span> is <span class="inlinecode">(<span class="id" type="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">5)</span> <span class="inlinecode">[<span class="id" type="var">X</span></span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span> <span class="inlinecode">3]</span> &mdash; that
    is, more formally, <span class="inlinecode"><span class="id" type="var">P'</span></span> is the Coq expression

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st'</span>&nbsp;⇒&nbsp;<span class="id" type="var">st'</span>&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;5)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">X</span>&nbsp;!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span>&nbsp;<span class="id" type="var">aeval</span>&nbsp;<span class="id" type="var">st</span>&nbsp;3&nbsp;;&nbsp;<span class="id" type="var">st</span>),
<div class="paragraph"> </div>

</div>
    which simplifies to

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st'</span>&nbsp;⇒&nbsp;<span class="id" type="var">st'</span>&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;5)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">X</span>&nbsp;!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span>&nbsp;3&nbsp;;&nbsp;<span class="id" type="var">st</span>)
<div class="paragraph"> </div>

</div>
    and further simplifies to

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;((<span class="id" type="var">X</span>&nbsp;!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span>&nbsp;3&nbsp;;&nbsp;<span class="id" type="var">st</span>)&nbsp;<span class="id" type="var">X</span>)&nbsp;≤&nbsp;5
<div class="paragraph"> </div>

</div>
    and finally to

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;3&nbsp;≤&nbsp;5.
<div class="paragraph"> </div>

</div>
    That is, <span class="inlinecode"><span class="id" type="var">P'</span></span> is the assertion that <span class="inlinecode">3</span> is less than or equal to
    <span class="inlinecode">5</span> (as expected). 
<div class="paragraph"> </div>

 For a more interesting example, suppose <span class="inlinecode"><span class="id" type="var">P'</span></span> is <span class="inlinecode">(<span class="id" type="var">X</span></span> <span class="inlinecode">≤</span> <span class="inlinecode">5)</span> <span class="inlinecode">[<span class="id" type="var">X</span></span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span>
    <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">+</span> <span class="inlinecode">1]</span>.  Formally, <span class="inlinecode"><span class="id" type="var">P'</span></span> is the Coq expression

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st'</span>&nbsp;⇒&nbsp;<span class="id" type="var">st'</span>&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;5)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">X</span>&nbsp;!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span>&nbsp;<span class="id" type="var">aeval</span>&nbsp;<span class="id" type="var">st</span>&nbsp;(<span class="id" type="var">X</span>&nbsp;+&nbsp;1)&nbsp;;&nbsp;<span class="id" type="var">st</span>),
<div class="paragraph"> </div>

</div>
    which simplifies to

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">X</span>&nbsp;!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span>&nbsp;<span class="id" type="var">aeval</span>&nbsp;<span class="id" type="var">st</span>&nbsp;(<span class="id" type="var">X</span>&nbsp;+&nbsp;1)&nbsp;;&nbsp;<span class="id" type="var">st</span>)&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;5
<div class="paragraph"> </div>

</div>
    and further simplifies to

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;⇒<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">aeval</span>&nbsp;<span class="id" type="var">st</span>&nbsp;(<span class="id" type="var">X</span>&nbsp;+&nbsp;1))&nbsp;≤&nbsp;5.
<div class="paragraph"> </div>

</div>
    That is, <span class="inlinecode"><span class="id" type="var">P'</span></span> is the assertion that <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">+</span> <span class="inlinecode">1</span> is at most <span class="inlinecode">5</span>.

<div class="paragraph"> </div>

 Now, using the concept of substitution, we can give the precise
    proof rule for assignment:
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule">&nbsp;&nbsp;</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_asgn) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{Q&nbsp;[X&nbsp;<span class="nowrap"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span>&nbsp;a]<span style='letter-spacing:-.4em;'>}</span>}&nbsp;X&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;a&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>
<div class="paragraph"> </div>

 We can prove formally that this rule is indeed valid. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_asgn</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">Q</span> <span class="id" type="var">X</span> <span class="id" type="var">a</span>,<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span> [<span class="id" type="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> <span class="id" type="var">a</span>]<span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">a</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<div class="togglescript" id="proofcontrol3" onclick="toggleDisplay('proof3');toggleDisplay('proofcontrol3')"><span class="show"></span></div>
<div class="proofscript" id="proof3" onclick="toggleDisplay('proof3');toggleDisplay('proofcontrol3')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">hoare_triple</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">Q</span> <span class="id" type="var">X</span> <span class="id" type="var">a</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">HE</span> <span class="id" type="var">HQ</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">inversion</span> <span class="id" type="var">HE</span>. <span class="id" type="tactic">subst</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">assn_sub</span> <span class="id" type="keyword">in</span> <span class="id" type="var">HQ</span>. <span class="id" type="tactic">assumption</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
Here's a first formal proof using this rule. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Example</span> <span class="id" type="var">assn_sub_example</span> :<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{(<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> &lt; 5) [<span class="id" type="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> <span class="id" type="var">X</span> + 1]<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> + 1<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> &lt; 5<span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;WORKED&nbsp;IN&nbsp;CLASS&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_asgn</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
Of course, what would be even more helpful is to prove this
    simpler triple:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;&lt;&nbsp;4<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;1&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;&lt;&nbsp;5<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
   We will see how to do so in the next section. 
<div class="paragraph"> </div>

<a name="lab56"></a><h4 class="section">Exercise: 2 stars, standard (hoare_asgn_examples)</h4>
 Translate these informal Hoare triples...

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;1)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;(<span class="id" type="var">X</span>&nbsp;≤&nbsp;10)&nbsp;[<span class="id" type="var">X</span>&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span>&nbsp;2&nbsp;*&nbsp;<span class="id" type="var">X</span>]&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;2&nbsp;*&nbsp;<span class="id" type="var">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;10&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
<br/>
&nbsp;&nbsp;&nbsp;&nbsp;2)&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;(0&nbsp;≤&nbsp;<span class="id" type="var">X</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;5)&nbsp;[<span class="id" type="var">X</span>&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span>&nbsp;3]&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;3<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;0&nbsp;≤&nbsp;<span class="id" type="var">X</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
   ...into formal statements (use the names <span class="inlinecode"><span class="id" type="var">assn_sub_ex<sub>1</sub></span></span>
   and <span class="inlinecode"><span class="id" type="var">assn_sub_ex<sub>2</sub></span></span>) and use <span class="inlinecode"><span class="id" type="var">hoare_asgn</span></span> to prove them. 
</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/><hr class='doublespaceincode'/>
<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">manual_grade_for_hoare_asgn_examples</span> : <span class="id" type="var">option</span> (<span class="id" type="var">nat</span>*<span class="id" type="var">string</span>) := <span class="id" type="var">None</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

<a name="lab57"></a><h4 class="section">Exercise: 2 stars, standard, recommended (hoare_asgn_wrong)</h4>
 The assignment rule looks backward to almost everyone the first
    time they see it.  If it still seems puzzling, it may help
    to think a little about alternative "forward" rules.  Here is a
    seemingly natural one:
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule">&nbsp;&nbsp;</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_asgn_wrong) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{&nbsp;True&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;X&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;a&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;X&nbsp;=&nbsp;a&nbsp;<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>    Give a counterexample showing that this rule is incorrect and
    argue informally that it is really a counterexample.  (Hint:
    The rule universally quantifies over the arithmetic expression
    <span class="inlinecode"><span class="id" type="var">a</span></span>, and your counterexample needs to exhibit an <span class="inlinecode"><span class="id" type="var">a</span></span> for which
    the rule doesn't work.) 
</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/><hr class='doublespaceincode'/>
<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">manual_grade_for_hoare_asgn_wrong</span> : <span class="id" type="var">option</span> (<span class="id" type="var">nat</span>*<span class="id" type="var">string</span>) := <span class="id" type="var">None</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

<a name="lab58"></a><h4 class="section">Exercise: 3 stars, advanced (hoare_asgn_fwd)</h4>
 However, by using a <i>parameter</i> <span class="inlinecode"><span class="id" type="var">m</span></span> (a Coq number) to remember the
    original value of <span class="inlinecode"><span class="id" type="var">X</span></span> we can define a Hoare rule for assignment
    that does, intuitively, "work forwards" rather than backwards.
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule">&nbsp;&nbsp;</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_asgn_fwd) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{fun&nbsp;st&nbsp;⇒&nbsp;P&nbsp;st&nbsp;∧&nbsp;st&nbsp;X&nbsp;=&nbsp;m<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">X&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;a</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{fun&nbsp;st&nbsp;⇒&nbsp;P&nbsp;st'&nbsp;∧&nbsp;st&nbsp;X&nbsp;=&nbsp;aeval&nbsp;st'&nbsp;a&nbsp;<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">(where&nbsp;st'&nbsp;=&nbsp;(X&nbsp;!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span>&nbsp;m&nbsp;;&nbsp;st))</td>
  <td></td>
</td>
</table></center>    Note that we use the original value of <span class="inlinecode"><span class="id" type="var">X</span></span> to reconstruct the
    state <span class="inlinecode"><span class="id" type="var">st'</span></span> before the assignment took place. Prove that this rule
    is correct.  (Also note that this rule is more complicated than
    <span class="inlinecode"><span class="id" type="var">hoare_asgn</span></span>.)

</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_asgn_fwd</span> :<br/>
&nbsp;&nbsp;<span style='font-size:120%;'>&forall;</span><span class="id" type="var">m</span> <span class="id" type="var">a</span> <span class="id" type="var">P</span>,<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">P</span> <span class="id" type="var">st</span> ∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">m</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">a</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">P</span> (<span class="id" type="var">X</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> <span class="id" type="var">m</span> ; <span class="id" type="var">st</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;∧ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">aeval</span> (<span class="id" type="var">X</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> <span class="id" type="var">m</span> ; <span class="id" type="var">st</span>) <span class="id" type="var">a</span> <span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

<a name="lab59"></a><h4 class="section">Exercise: 2 stars, advanced, optional (hoare_asgn_fwd_exists)</h4>
 Another way to define a forward rule for assignment is to
    existentially quantify over the previous value of the assigned
    variable.  Prove that it is correct.
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule">&nbsp;&nbsp;</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_asgn_fwd_exists) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{fun&nbsp;st&nbsp;⇒&nbsp;P&nbsp;st<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">X&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;a</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{fun&nbsp;st&nbsp;⇒&nbsp;<span style='font-size:120%;'>&exist;</span>m,&nbsp;P&nbsp;(X&nbsp;!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span>&nbsp;m&nbsp;;&nbsp;st)&nbsp;∧</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">st&nbsp;X&nbsp;=&nbsp;aeval&nbsp;(X&nbsp;!<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span>&nbsp;m&nbsp;;&nbsp;st)&nbsp;a&nbsp;<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>
</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_asgn_fwd_exists</span> :<br/>
&nbsp;&nbsp;<span style='font-size:120%;'>&forall;</span><span class="id" type="var">a</span> <span class="id" type="var">P</span>,<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">P</span> <span class="id" type="var">st</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">a</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span style='font-size:120%;'>&exist;</span><span class="id" type="var">m</span>, <span class="id" type="var">P</span> (<span class="id" type="var">X</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> <span class="id" type="var">m</span> ; <span class="id" type="var">st</span>) ∧<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">aeval</span> (<span class="id" type="var">X</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> <span class="id" type="var">m</span> ; <span class="id" type="var">st</span>) <span class="id" type="var">a</span> <span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">a</span> <span class="id" type="var">P</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 

<div class="doc">
<a name="lab60"></a><h2 class="section">Consequence</h2>

<div class="paragraph"> </div>

 Sometimes the preconditions and postconditions we get from the
    Hoare rules won't quite be the ones we want in the particular
    situation at hand &mdash; they may be logically equivalent but have a
    different syntactic form that fails to unify with the goal we are
    trying to prove, or they actually may be logically weaker (for
    preconditions) or stronger (for postconditions) than what we need.

<div class="paragraph"> </div>

    For instance, while

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{(<span class="id" type="var">X</span>&nbsp;=&nbsp;3)&nbsp;[<span class="id" type="var">X</span>&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span>&nbsp;3]<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;3&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;3<span style='letter-spacing:-.4em;'>}</span>},
<div class="paragraph"> </div>

</div>
    follows directly from the assignment rule,

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;3&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;=&nbsp;3<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    does not.  This triple is valid, but it is not an instance of
    <span class="inlinecode"><span class="id" type="var">hoare_asgn</span></span> because <span class="inlinecode"><span class="id" type="var">True</span></span> and <span class="inlinecode">(<span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">3)</span> <span class="inlinecode">[<span class="id" type="var">X</span></span> <span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span> <span class="inlinecode">3]</span> are not
    syntactically equal assertions.  However, they are logically
    <i>equivalent</i>, so if one triple is valid, then the other must
    certainly be as well.  We can capture this observation with the
    following rule:
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P'<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">P&nbsp;<span class="nowrap"><span class="nowrap"><span style='font-size:85%;'><span style='letter-spacing:-.2em;'><<</span><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span>&nbsp;P'</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_consequence_pre_equiv) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>
<div class="paragraph"> </div>

 Taking this line of thought a bit further, we can see that
    strengthening the precondition or weakening the postcondition of a
    valid triple always produces another valid triple. This
    observation is captured by two <i>Rules of Consequence</i>.
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P'<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">P&nbsp;<span class="nowrap"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span>&nbsp;P'</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_consequence_pre) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center><center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q'<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">Q'&nbsp;<span class="nowrap"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span>&nbsp;Q</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_consequence_post) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>
<div class="paragraph"> </div>

 Here are the formal versions: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_consequence_pre</span> : <span style='font-size:120%;'>&forall;</span>(<span class="id" type="var">P</span> <span class="id" type="var">P'</span> <span class="id" type="var">Q</span> : <span class="id" type="var">Assertion</span>) <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P'</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;<span class="id" type="var">P</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">P'</span> →<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<div class="togglescript" id="proofcontrol4" onclick="toggleDisplay('proof4');toggleDisplay('proofcontrol4')"><span class="show"></span></div>
<div class="proofscript" id="proof4" onclick="toggleDisplay('proof4');toggleDisplay('proofcontrol4')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">P'</span> <span class="id" type="var">Q</span> <span class="id" type="var">c</span> <span class="id" type="var">Hhoare</span> <span class="id" type="var">Himp</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">Hc</span> <span class="id" type="var">HP</span>. <span class="id" type="tactic">apply</span> (<span class="id" type="var">Hhoare</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span>).<br/>
&nbsp;&nbsp;<span class="id" type="tactic">assumption</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">Himp</span>. <span class="id" type="tactic">assumption</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>

<br/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_consequence_post</span> : <span style='font-size:120%;'>&forall;</span>(<span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">Q'</span> : <span class="id" type="var">Assertion</span>) <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q'</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;<span class="id" type="var">Q'</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">Q</span> →<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<div class="togglescript" id="proofcontrol5" onclick="toggleDisplay('proof5');toggleDisplay('proofcontrol5')"><span class="show"></span></div>
<div class="proofscript" id="proof5" onclick="toggleDisplay('proof5');toggleDisplay('proofcontrol5')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">Q'</span> <span class="id" type="var">c</span> <span class="id" type="var">Hhoare</span> <span class="id" type="var">Himp</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">Hc</span> <span class="id" type="var">HP</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">Himp</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> (<span class="id" type="var">Hhoare</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span>).<br/>
&nbsp;&nbsp;<span class="id" type="tactic">assumption</span>. <span class="id" type="tactic">assumption</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
For example, we can use the first consequence rule like this:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;1&nbsp;=&nbsp;1&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;1&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    Or, formally... 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Example</span> <span class="id" type="var">hoare_asgn_example1</span> :<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 1 <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = 1<span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;WORKED&nbsp;IN&nbsp;CLASS&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_consequence_pre</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">with</span> (<span class="id" type="var">P'</span> := (<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = 1) [<span class="id" type="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> 1]).<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_asgn</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> <span class="id" type="var">H</span>. <span class="id" type="tactic">unfold</span> <span class="id" type="var">assn_sub</span>, <span class="id" type="var">t_update</span>. <span class="id" type="tactic">simpl</span>. <span class="id" type="tactic">reflexivity</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
We can also use it to prove the example mentioned earlier.

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;&lt;&nbsp;4&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;(<span class="id" type="var">X</span>&nbsp;&lt;&nbsp;5)[<span class="id" type="var">X</span>&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;1]&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;&lt;&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
   Or, formally ... 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Example</span> <span class="id" type="var">assn_sub_example2</span> :<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{(<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> &lt; 4)<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> + 1<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> &lt; 5<span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;WORKED&nbsp;IN&nbsp;CLASS&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_consequence_pre</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="keyword">with</span> (<span class="id" type="var">P'</span> := (<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> &lt; 5) [<span class="id" type="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> <span class="id" type="var">X</span> + 1]).<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_asgn</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> <span class="id" type="var">H</span>. <span class="id" type="tactic">unfold</span> <span class="id" type="var">assn_sub</span>, <span class="id" type="var">t_update</span>. <span class="id" type="tactic">simpl</span>. <span class="id" type="tactic">omega</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
Finally, for convenience in proofs, here is a combined rule of
    consequence that allows us to vary both the precondition and the
    postcondition in one go.
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P'<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q'<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">P&nbsp;<span class="nowrap"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span>&nbsp;P'</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">Q'&nbsp;<span class="nowrap"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span>&nbsp;Q</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_consequence) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>
</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_consequence</span> : <span style='font-size:120%;'>&forall;</span>(<span class="id" type="var">P</span> <span class="id" type="var">P'</span> <span class="id" type="var">Q</span> <span class="id" type="var">Q'</span> : <span class="id" type="var">Assertion</span>) <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P'</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q'</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;<span class="id" type="var">P</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">P'</span> →<br/>
&nbsp;&nbsp;<span class="id" type="var">Q'</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">Q</span> →<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<div class="togglescript" id="proofcontrol6" onclick="toggleDisplay('proof6');toggleDisplay('proofcontrol6')"><span class="show"></span></div>
<div class="proofscript" id="proof6" onclick="toggleDisplay('proof6');toggleDisplay('proofcontrol6')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">P'</span> <span class="id" type="var">Q</span> <span class="id" type="var">Q'</span> <span class="id" type="var">c</span> <span class="id" type="var">Hht</span> <span class="id" type="var">HPP'</span> <span class="id" type="var">HQ'Q</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_consequence_pre</span> <span class="id" type="keyword">with</span> (<span class="id" type="var">P'</span> := <span class="id" type="var">P'</span>).<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_consequence_post</span> <span class="id" type="keyword">with</span> (<span class="id" type="var">Q'</span> := <span class="id" type="var">Q'</span>).<br/>
&nbsp;&nbsp;<span class="id" type="tactic">assumption</span>. <span class="id" type="tactic">assumption</span>. <span class="id" type="tactic">assumption</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
<a name="lab61"></a><h2 class="section">Digression: The <span class="inlinecode"><span class="id" type="tactic">eapply</span></span> Tactic</h2>

<div class="paragraph"> </div>

 This is a good moment to take another look at the <span class="inlinecode"><span class="id" type="tactic">eapply</span></span> tactic,
    which we introduced briefly in the <a href="https://www.cis.upenn.edu/~bcpierce/sf/lf-current/Auto.html"><span class="inlineref">Auto</span></a> chapter of
    <i>Logical Foundations</i>.

<div class="paragraph"> </div>

    We had to write "<span class="inlinecode"><span class="id" type="keyword">with</span></span> <span class="inlinecode">(<span class="id" type="var">P'</span></span> <span class="inlinecode">:=</span> <span class="inlinecode">...)</span>" explicitly in the proof of
    <span class="inlinecode"><span class="id" type="var">hoare_asgn_example1</span></span> and <span class="inlinecode"><span class="id" type="var">hoare_consequence</span></span> above, to make sure
    that all of the metavariables in the premises to the
    <span class="inlinecode"><span class="id" type="var">hoare_consequence_pre</span></span> rule would be set to specific
    values.  (Since <span class="inlinecode"><span class="id" type="var">P'</span></span> doesn't appear in the conclusion of
    <span class="inlinecode"><span class="id" type="var">hoare_consequence_pre</span></span>, the process of unifying the conclusion
    with the current goal doesn't constrain <span class="inlinecode"><span class="id" type="var">P'</span></span> to a specific
    assertion.)

<div class="paragraph"> </div>

    This is annoying, both because the assertion is a bit long and
    also because, in <span class="inlinecode"><span class="id" type="var">hoare_asgn_example1</span></span>, the very next thing we are
    going to do &mdash; applying the <span class="inlinecode"><span class="id" type="var">hoare_asgn</span></span> rule &mdash; will tell us
    exactly what it should be!  We can use <span class="inlinecode"><span class="id" type="tactic">eapply</span></span> instead of <span class="inlinecode"><span class="id" type="tactic">apply</span></span>
    to tell Coq, essentially, "Be patient: The missing part is going
    to be filled in later in the proof." 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Example</span> <span class="id" type="var">hoare_asgn_example1'</span> :<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 1<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = 1<span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_pre</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_asgn</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> <span class="id" type="var">H</span>. <span class="id" type="tactic">reflexivity</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
In general, the <span class="inlinecode"><span class="id" type="tactic">eapply</span></span> <span class="inlinecode"><span class="id" type="var">H</span></span> tactic works just like <span class="inlinecode"><span class="id" type="tactic">apply</span></span> <span class="inlinecode"><span class="id" type="var">H</span></span> except
    that, instead of failing if unifying the goal with the conclusion
    of <span class="inlinecode"><span class="id" type="var">H</span></span> does not determine how to instantiate all of the variables
    appearing in the premises of <span class="inlinecode"><span class="id" type="var">H</span></span>, <span class="inlinecode"><span class="id" type="tactic">eapply</span></span> <span class="inlinecode"><span class="id" type="var">H</span></span> will replace these
    variables with <i>existential variables</i> (written <span class="inlinecode">?<span class="id" type="var">nnn</span></span>), which
    function as placeholders for expressions that will be
    determined (by further unification) later in the proof. 
<div class="paragraph"> </div>

 In order for <span class="inlinecode"><span class="id" type="keyword">Qed</span></span> to succeed, all existential variables need to
    be determined by the end of the proof. Otherwise Coq
    will (rightly) refuse to accept the proof. Remember that the Coq
    tactics build proof objects, and proof objects containing
    existential variables are not complete. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Lemma</span> <span class="id" type="var">silly1</span> : <span style='font-size:120%;'>&forall;</span>(<span class="id" type="var">P</span> : <span class="id" type="var">nat</span> → <span class="id" type="var">nat</span> → <span class="id" type="keyword">Prop</span>) (<span class="id" type="var">Q</span> : <span class="id" type="var">nat</span> → <span class="id" type="keyword">Prop</span>),<br/>
&nbsp;&nbsp;(<span style='font-size:120%;'>&forall;</span><span class="id" type="var">x</span> <span class="id" type="var">y</span> : <span class="id" type="var">nat</span>, <span class="id" type="var">P</span> <span class="id" type="var">x</span> <span class="id" type="var">y</span>) →<br/>
&nbsp;&nbsp;(<span style='font-size:120%;'>&forall;</span><span class="id" type="var">x</span> <span class="id" type="var">y</span> : <span class="id" type="var">nat</span>, <span class="id" type="var">P</span> <span class="id" type="var">x</span> <span class="id" type="var">y</span> → <span class="id" type="var">Q</span> <span class="id" type="var">x</span>) →<br/>
&nbsp;&nbsp;<span class="id" type="var">Q</span> 42.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">HP</span> <span class="id" type="var">HQ</span>. <span class="id" type="tactic">eapply</span> <span class="id" type="var">HQ</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">HP</span>.<br/>
</div>

<div class="doc">
Coq gives a warning after <span class="inlinecode"><span class="id" type="tactic">apply</span></span> <span class="inlinecode"><span class="id" type="var">HP</span></span>.  ("All the remaining goals
    are on the shelf," means that we've finished all our top-level
    proof obligations but along the way we've put some aside to be
    done later, and we have not finished those.)  Trying to close the
    proof with <span class="inlinecode"><span class="id" type="keyword">Qed</span></span> gives an error. 
</div>
<div class="code code-tight">
<span class="id" type="keyword">Abort</span>.<br/>
</div>

<div class="doc">
An additional constraint is that existential variables cannot be
    instantiated with terms containing ordinary variables that did not
    exist at the time the existential variable was created.  (The
    reason for this technical restriction is that allowing such
    instantiation would lead to inconsistency of Coq's logic.) 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Lemma</span> <span class="id" type="var">silly2</span> :<br/>
&nbsp;&nbsp;<span style='font-size:120%;'>&forall;</span>(<span class="id" type="var">P</span> : <span class="id" type="var">nat</span> → <span class="id" type="var">nat</span> → <span class="id" type="keyword">Prop</span>) (<span class="id" type="var">Q</span> : <span class="id" type="var">nat</span> → <span class="id" type="keyword">Prop</span>),<br/>
&nbsp;&nbsp;(<span style='font-size:120%;'>&exist;</span><span class="id" type="var">y</span>, <span class="id" type="var">P</span> 42 <span class="id" type="var">y</span>) →<br/>
&nbsp;&nbsp;(<span style='font-size:120%;'>&forall;</span><span class="id" type="var">x</span> <span class="id" type="var">y</span> : <span class="id" type="var">nat</span>, <span class="id" type="var">P</span> <span class="id" type="var">x</span> <span class="id" type="var">y</span> → <span class="id" type="var">Q</span> <span class="id" type="var">x</span>) →<br/>
&nbsp;&nbsp;<span class="id" type="var">Q</span> 42.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">HP</span> <span class="id" type="var">HQ</span>. <span class="id" type="tactic">eapply</span> <span class="id" type="var">HQ</span>. <span class="id" type="tactic">destruct</span> <span class="id" type="var">HP</span> <span class="id" type="keyword">as</span> [<span class="id" type="var">y</span> <span class="id" type="var">HP'</span>].<br/>
</div>

<div class="doc">
Doing <span class="inlinecode"><span class="id" type="tactic">apply</span></span> <span class="inlinecode"><span class="id" type="var">HP'</span></span> above fails with the following error:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Error</span>:&nbsp;<span class="id" type="var">Impossible</span>&nbsp;<span class="id" type="var">to</span>&nbsp;<span class="id" type="var">unify</span>&nbsp;"?175"&nbsp;<span class="id" type="keyword">with</span>&nbsp;"y".
<div class="paragraph"> </div>

</div>
    In this case there is an easy fix: doing <span class="inlinecode"><span class="id" type="tactic">destruct</span></span> <span class="inlinecode"><span class="id" type="var">HP</span></span> <i>before</i>
    doing <span class="inlinecode"><span class="id" type="tactic">eapply</span></span> <span class="inlinecode"><span class="id" type="var">HQ</span></span>. 
</div>
<div class="code code-tight">
<span class="id" type="keyword">Abort</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">silly2_fixed</span> :<br/>
&nbsp;&nbsp;<span style='font-size:120%;'>&forall;</span>(<span class="id" type="var">P</span> : <span class="id" type="var">nat</span> → <span class="id" type="var">nat</span> → <span class="id" type="keyword">Prop</span>) (<span class="id" type="var">Q</span> : <span class="id" type="var">nat</span> → <span class="id" type="keyword">Prop</span>),<br/>
&nbsp;&nbsp;(<span style='font-size:120%;'>&exist;</span><span class="id" type="var">y</span>, <span class="id" type="var">P</span> 42 <span class="id" type="var">y</span>) →<br/>
&nbsp;&nbsp;(<span style='font-size:120%;'>&forall;</span><span class="id" type="var">x</span> <span class="id" type="var">y</span> : <span class="id" type="var">nat</span>, <span class="id" type="var">P</span> <span class="id" type="var">x</span> <span class="id" type="var">y</span> → <span class="id" type="var">Q</span> <span class="id" type="var">x</span>) →<br/>
&nbsp;&nbsp;<span class="id" type="var">Q</span> 42.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">HP</span> <span class="id" type="var">HQ</span>. <span class="id" type="tactic">destruct</span> <span class="id" type="var">HP</span> <span class="id" type="keyword">as</span> [<span class="id" type="var">y</span> <span class="id" type="var">HP'</span>].<br/>
&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">HQ</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">HP'</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
The <span class="inlinecode"><span class="id" type="tactic">apply</span></span> <span class="inlinecode"><span class="id" type="var">HP'</span></span> in the last step unifies the existential variable
    in the goal with the variable <span class="inlinecode"><span class="id" type="var">y</span></span>.

<div class="paragraph"> </div>

    Note that the <span class="inlinecode"><span class="id" type="tactic">assumption</span></span> tactic doesn't work in this case, since
    it cannot handle existential variables.  However, Coq also
    provides an <span class="inlinecode"><span class="id" type="var">eassumption</span></span> tactic that solves the goal if one of
    the premises matches the goal up to instantiations of existential
    variables. We can use it instead of <span class="inlinecode"><span class="id" type="tactic">apply</span></span> <span class="inlinecode"><span class="id" type="var">HP'</span></span> if we like. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Lemma</span> <span class="id" type="var">silly2_eassumption</span> : <span style='font-size:120%;'>&forall;</span>(<span class="id" type="var">P</span> : <span class="id" type="var">nat</span> → <span class="id" type="var">nat</span> → <span class="id" type="keyword">Prop</span>) (<span class="id" type="var">Q</span> : <span class="id" type="var">nat</span> → <span class="id" type="keyword">Prop</span>),<br/>
&nbsp;&nbsp;(<span style='font-size:120%;'>&exist;</span><span class="id" type="var">y</span>, <span class="id" type="var">P</span> 42 <span class="id" type="var">y</span>) →<br/>
&nbsp;&nbsp;(<span style='font-size:120%;'>&forall;</span><span class="id" type="var">x</span> <span class="id" type="var">y</span> : <span class="id" type="var">nat</span>, <span class="id" type="var">P</span> <span class="id" type="var">x</span> <span class="id" type="var">y</span> → <span class="id" type="var">Q</span> <span class="id" type="var">x</span>) →<br/>
&nbsp;&nbsp;<span class="id" type="var">Q</span> 42.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">HP</span> <span class="id" type="var">HQ</span>. <span class="id" type="tactic">destruct</span> <span class="id" type="var">HP</span> <span class="id" type="keyword">as</span> [<span class="id" type="var">y</span> <span class="id" type="var">HP'</span>]. <span class="id" type="tactic">eapply</span> <span class="id" type="var">HQ</span>. <span class="id" type="var">eassumption</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
<a name="lab62"></a><h4 class="section">Exercise: 2 stars, standard (hoare_asgn_examples_2)</h4>
 Translate these informal Hoare triples...

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;1&nbsp;≤&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;1&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;0&nbsp;≤&nbsp;3&nbsp;∧&nbsp;3&nbsp;≤&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;3&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;0&nbsp;≤&nbsp;<span class="id" type="var">X</span>&nbsp;∧&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;5&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
   ...into formal statements (name them <span class="inlinecode"><span class="id" type="var">assn_sub_ex<sub>1</sub>'</span></span> and
   <span class="inlinecode"><span class="id" type="var">assn_sub_ex<sub>2</sub>'</span></span>) and use <span class="inlinecode"><span class="id" type="var">hoare_asgn</span></span> and <span class="inlinecode"><span class="id" type="var">hoare_consequence_pre</span></span>
   to prove them. 
</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/><hr class='doublespaceincode'/>
<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">manual_grade_for_hoare_asgn_examples_2</span> : <span class="id" type="var">option</span> (<span class="id" type="var">nat</span>*<span class="id" type="var">string</span>) := <span class="id" type="var">None</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 

<div class="doc">
<a name="lab63"></a><h2 class="section">Skip</h2>

<div class="paragraph"> </div>

 Since <span class="inlinecode"><span class="id" type="var">SKIP</span></span> doesn't change the state, it preserves any
    assertion <span class="inlinecode"><span class="id" type="var">P</span></span>:
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule">&nbsp;&nbsp;</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_skip) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{&nbsp;P&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;SKIP&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;P&nbsp;<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>
</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_skip</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">P</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">SKIP</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<div class="togglescript" id="proofcontrol7" onclick="toggleDisplay('proof7');toggleDisplay('proofcontrol7')"><span class="show"></span></div>
<div class="proofscript" id="proof7" onclick="toggleDisplay('proof7');toggleDisplay('proofcontrol7')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">H</span> <span class="id" type="var">HP</span>. <span class="id" type="tactic">inversion</span> <span class="id" type="var">H</span>. <span class="id" type="tactic">subst</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">assumption</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
<a name="lab64"></a><h2 class="section">Sequencing</h2>

<div class="paragraph"> </div>

 More interestingly, if the command <span class="inlinecode"><span class="id" type="var">c<sub>1</sub></span></span> takes any state where
    <span class="inlinecode"><span class="id" type="var">P</span></span> holds to a state where <span class="inlinecode"><span class="id" type="var">Q</span></span> holds, and if <span class="inlinecode"><span class="id" type="var">c<sub>2</sub></span></span> takes any
    state where <span class="inlinecode"><span class="id" type="var">Q</span></span> holds to one where <span class="inlinecode"><span class="id" type="var">R</span></span> holds, then doing <span class="inlinecode"><span class="id" type="var">c<sub>1</sub></span></span>
    followed by <span class="inlinecode"><span class="id" type="var">c<sub>2</sub></span></span> will take any state where <span class="inlinecode"><span class="id" type="var">P</span></span> holds to one
    where <span class="inlinecode"><span class="id" type="var">R</span></span> holds:
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{&nbsp;P&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c<sub>1</sub>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;Q&nbsp;<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{&nbsp;Q&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c<sub>2</sub>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;R&nbsp;<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_seq) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{&nbsp;P&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c<sub>1</sub>;;c<sub>2</sub>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;R&nbsp;<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>
</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_seq</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">R</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c<sub>2</sub></span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">R</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c<sub>1</sub></span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c<sub>1</sub></span>;;<span class="id" type="var">c<sub>2</sub></span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">R</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<div class="togglescript" id="proofcontrol8" onclick="toggleDisplay('proof8');toggleDisplay('proofcontrol8')"><span class="show"></span></div>
<div class="proofscript" id="proof8" onclick="toggleDisplay('proof8');toggleDisplay('proofcontrol8')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">R</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">H<sub>1</sub></span> <span class="id" type="var">H<sub>2</sub></span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">H<sub>12</sub></span> <span class="id" type="var">Pre</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">inversion</span> <span class="id" type="var">H<sub>12</sub></span>; <span class="id" type="tactic">subst</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> (<span class="id" type="var">H<sub>1</sub></span> <span class="id" type="var">st'0</span> <span class="id" type="var">st'</span>); <span class="id" type="tactic">try</span> <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> (<span class="id" type="var">H<sub>2</sub></span> <span class="id" type="var">st</span> <span class="id" type="var">st'0</span>); <span class="id" type="tactic">assumption</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
Note that, in the formal rule <span class="inlinecode"><span class="id" type="var">hoare_seq</span></span>, the premises are
    given in backwards order (<span class="inlinecode"><span class="id" type="var">c<sub>2</sub></span></span> before <span class="inlinecode"><span class="id" type="var">c<sub>1</sub></span></span>).  This matches the
    natural flow of information in many of the situations where we'll
    use the rule, since the natural way to construct a Hoare-logic
    proof is to begin at the end of the program (with the final
    postcondition) and push postconditions backwards through commands
    until we reach the beginning. 
<div class="paragraph"> </div>

 Informally, a nice way of displaying a proof using the sequencing
    rule is as a "decorated program" where the intermediate assertion
    <span class="inlinecode"><span class="id" type="var">Q</span></span> is written between <span class="inlinecode"><span class="id" type="var">c<sub>1</sub></span></span> and <span class="inlinecode"><span class="id" type="var">c<sub>2</sub></span></span>:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">a</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">a</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;&nbsp;&nbsp;&nbsp;&lt;---&nbsp;<span class="id" type="var">decoration</span>&nbsp;<span class="id" type="keyword">for</span>&nbsp;<span class="id" type="var">Q</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">SKIP</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">n</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

<div class="paragraph"> </div>

 Here's an example of a program involving both assignment and
    sequencing. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Example</span> <span class="id" type="var">hoare_asgn_example3</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">a</span> <span class="id" type="var">n</span>,<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">aeval</span> <span class="id" type="var">st</span> <span class="id" type="var">a</span> = <span class="id" type="var">n</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">a</span>;; <span class="id" type="var">SKIP</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">n</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">a</span> <span class="id" type="var">n</span>. <span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_seq</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;right&nbsp;part&nbsp;of&nbsp;seq&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_skip</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;left&nbsp;part&nbsp;of&nbsp;seq&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_pre</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_asgn</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> <span class="id" type="var">H</span>. <span class="id" type="tactic">subst</span>. <span class="id" type="tactic">reflexivity</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
We typically use <span class="inlinecode"><span class="id" type="var">hoare_seq</span></span> in conjunction with
    <span class="inlinecode"><span class="id" type="var">hoare_consequence_pre</span></span> and the <span class="inlinecode"><span class="id" type="tactic">eapply</span></span> tactic, as in this
    example. 
<div class="paragraph"> </div>

<a name="lab65"></a><h4 class="section">Exercise: 2 stars, standard, recommended (hoare_asgn_example4)</h4>
 Translate this "decorated program" into a formal proof:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;1&nbsp;=&nbsp;1&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;1&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;1&nbsp;∧&nbsp;2&nbsp;=&nbsp;2&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;1&nbsp;∧&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;2&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
   (Note the use of "<span class="inlinecode"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span>" decorations, each marking a use of
   <span class="inlinecode"><span class="id" type="var">hoare_consequence_pre</span></span>.) 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Example</span> <span class="id" type="var">hoare_asgn_example4</span> :<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 1;; <span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 2<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = 1 ∧ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = 2<span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

<a name="lab66"></a><h4 class="section">Exercise: 3 stars, standard (swap_exercise)</h4>
 Write an Imp program <span class="inlinecode"><span class="id" type="var">c</span></span> that swaps the values of <span class="inlinecode"><span class="id" type="var">X</span></span> and <span class="inlinecode"><span class="id" type="var">Y</span></span> and
    show that it satisfies the following specification:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">X</span>&nbsp;≤&nbsp;<span class="id" type="var">Y</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">c</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Y</span>&nbsp;≤&nbsp;<span class="id" type="var">X</span><span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    Your proof should not need to use <span class="inlinecode"><span class="id" type="tactic">unfold</span></span> <span class="inlinecode"><span class="id" type="var">hoare_triple</span></span>.  (Hint:
    Remember that the assignment rule works best when it's applied
    "back to front," from the postcondition to the precondition.  So
    your proof will want to start at the end and work back to the
    beginning of your program.)  
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">swap_program</span> : <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;REPLACE&nbsp;THIS&nbsp;LINE&nbsp;WITH&nbsp;":=&nbsp;_your_definition_&nbsp;."&nbsp;*)</span>. <span class="id" type="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">swap_exercise</span> :<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">Y</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">swap_program</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">X</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

<a name="lab67"></a><h4 class="section">Exercise: 3 stars, standard (hoarestate1)</h4>
 Explain why the following proposition can't be proven:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='font-size:120%;'>&forall;</span>(<span class="id" type="var">a</span>&nbsp;:&nbsp;<span class="id" type="var">aexp</span>)&nbsp;(<span class="id" type="var">n</span>&nbsp;:&nbsp;<span class="id" type="var">nat</span>),<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;⇒&nbsp;<span class="id" type="var">aeval</span>&nbsp;<span class="id" type="var">st</span>&nbsp;<span class="id" type="var">a</span>&nbsp;=&nbsp;<span class="id" type="var">n</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;3;;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">a</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span>&nbsp;<span class="id" type="var">st</span>&nbsp;⇒&nbsp;<span class="id" type="var">st</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">n</span><span style='letter-spacing:-.4em;'>}</span>}.
<div class="paragraph"> </div>

</div>

</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/><hr class='doublespaceincode'/>
<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">manual_grade_for_hoarestate1</span> : <span class="id" type="var">option</span> (<span class="id" type="var">nat</span>*<span class="id" type="var">string</span>) := <span class="id" type="var">None</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 

<div class="doc">
<a name="lab68"></a><h2 class="section">Conditionals</h2>

<div class="paragraph"> </div>

 What sort of rule do we want for reasoning about conditional
    commands? 

<div class="paragraph"> </div>

    Certainly, if the same assertion <span class="inlinecode"><span class="id" type="var">Q</span></span> holds after executing
    either of the branches, then it holds after the whole conditional. 
    So we might be tempted to write:
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c<sub>1</sub>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c<sub>2</sub>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td class="infrulenamecol" rowspan="3">
    &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}&nbsp;TEST&nbsp;b&nbsp;THEN&nbsp;c<sub>1</sub>&nbsp;ELSE&nbsp;c<sub>2</sub>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>
<div class="paragraph"> </div>

 However, this is rather weak. For example, using this rule,
   we cannot show

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">True</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">TEST</span>&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;0<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">THEN</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">ELSE</span>&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;1<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">FI</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;≤&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
   since the rule tells us nothing about the state in which the
   assignments take place in the "then" and "else" branches. 
<div class="paragraph"> </div>

 Fortunately, we can say something more precise.  In the
    "then" branch, we know that the boolean expression <span class="inlinecode"><span class="id" type="var">b</span></span> evaluates to
    <span class="inlinecode"><span class="id" type="var">true</span></span>, and in the "else" branch, we know it evaluates to <span class="inlinecode"><span class="id" type="var">false</span></span>.
    Making this information available in the premises of the rule gives
    us more information to work with when reasoning about the behavior
    of <span class="inlinecode"><span class="id" type="var">c<sub>1</sub></span></span> and <span class="inlinecode"><span class="id" type="var">c<sub>2</sub></span></span> (i.e., the reasons why they establish the
    postcondition <span class="inlinecode"><span class="id" type="var">Q</span></span>). 
<div class="paragraph"> </div>

<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P&nbsp;∧&nbsp;&nbsp;&nbsp;b<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c<sub>1</sub>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P&nbsp;∧&nbsp;¬b<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c<sub>2</sub>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_if) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}&nbsp;TEST&nbsp;b&nbsp;THEN&nbsp;c<sub>1</sub>&nbsp;ELSE&nbsp;c<sub>2</sub>&nbsp;FI&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>
<div class="paragraph"> </div>

 To interpret this rule formally, we need to do a little work.
    Strictly speaking, the assertion we've written, <span class="inlinecode"><span class="id" type="var">P</span></span> <span class="inlinecode">∧</span> <span class="inlinecode"><span class="id" type="var">b</span></span>, is the
    conjunction of an assertion and a boolean expression &mdash; i.e., it
    doesn't typecheck.  To fix this, we need a way of formally
    "lifting" any bexp <span class="inlinecode"><span class="id" type="var">b</span></span> to an assertion.  We'll write <span class="inlinecode"><span class="id" type="var">bassn</span></span> <span class="inlinecode"><span class="id" type="var">b</span></span> for
    the assertion "the boolean expression <span class="inlinecode"><span class="id" type="var">b</span></span> evaluates to <span class="inlinecode"><span class="id" type="var">true</span></span> (in
    the given state)." 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">bassn</span> <span class="id" type="var">b</span> : <span class="id" type="var">Assertion</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ (<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">true</span>).<br/>
</div>

<div class="doc">
A couple of useful facts about <span class="inlinecode"><span class="id" type="var">bassn</span></span>: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Lemma</span> <span class="id" type="var">bexp_eval_true</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">b</span> <span class="id" type="var">st</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">true</span> → (<span class="id" type="var">bassn</span> <span class="id" type="var">b</span>) <span class="id" type="var">st</span>.<br/>
<div class="togglescript" id="proofcontrol9" onclick="toggleDisplay('proof9');toggleDisplay('proofcontrol9')"><span class="show"></span></div>
<div class="proofscript" id="proof9" onclick="toggleDisplay('proof9');toggleDisplay('proofcontrol9')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">b</span> <span class="id" type="var">st</span> <span class="id" type="var">Hbe</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">bassn</span>. <span class="id" type="tactic">assumption</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>

<br/>
<span class="id" type="keyword">Lemma</span> <span class="id" type="var">bexp_eval_false</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">b</span> <span class="id" type="var">st</span>,<br/>
&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">false</span> → ¬((<span class="id" type="var">bassn</span> <span class="id" type="var">b</span>) <span class="id" type="var">st</span>).<br/>
<div class="togglescript" id="proofcontrol10" onclick="toggleDisplay('proof10');toggleDisplay('proofcontrol10')"><span class="show"></span></div>
<div class="proofscript" id="proof10" onclick="toggleDisplay('proof10');toggleDisplay('proofcontrol10')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">b</span> <span class="id" type="var">st</span> <span class="id" type="var">Hbe</span> <span class="id" type="var">contra</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">bassn</span> <span class="id" type="keyword">in</span> <span class="id" type="var">contra</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> → <span class="id" type="var">contra</span> <span class="id" type="keyword">in</span> <span class="id" type="var">Hbe</span>. <span class="id" type="tactic">inversion</span> <span class="id" type="var">Hbe</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
Now we can formalize the Hoare proof rule for conditionals
    and prove it correct. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_if</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">b</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span>,<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">P</span> <span class="id" type="var">st</span> ∧ <span class="id" type="var">bassn</span> <span class="id" type="var">b</span> <span class="id" type="var">st</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c<sub>1</sub></span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">P</span> <span class="id" type="var">st</span> ∧ ¬(<span class="id" type="var">bassn</span> <span class="id" type="var">b</span> <span class="id" type="var">st</span>)<span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c<sub>2</sub></span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">TEST</span> <span class="id" type="var">b</span> <span class="id" type="var">THEN</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">ELSE</span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">FI</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<div class="togglescript" id="proofcontrol11" onclick="toggleDisplay('proof11');toggleDisplay('proofcontrol11')"><span class="show"></span></div>
<div class="proofscript" id="proof11" onclick="toggleDisplay('proof11');toggleDisplay('proofcontrol11')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">b</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">HTrue</span> <span class="id" type="var">HFalse</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">HE</span> <span class="id" type="var">HP</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">inversion</span> <span class="id" type="var">HE</span>; <span class="id" type="tactic">subst</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;b&nbsp;is&nbsp;true&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> (<span class="id" type="var">HTrue</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span>).<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">split</span>. <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">bexp_eval_true</span>. <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;b&nbsp;is&nbsp;false&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> (<span class="id" type="var">HFalse</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span>).<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">split</span>. <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">bexp_eval_false</span>. <span class="id" type="tactic">assumption</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
<a name="lab69"></a><h3 class="section">Example</h3>

<div class="paragraph"> </div>

 Here is a formal proof that the program we used to motivate the
    rule satisfies the specification we gave. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Example</span> <span class="id" type="var">if_example</span> :<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">TEST</span> <span class="id" type="var">X</span> = 0<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">THEN</span> <span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 2<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">ELSE</span> <span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> + 1<br/>
&nbsp;&nbsp;<span class="id" type="var">FI</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> ≤ <span class="id" type="var">st</span> <span class="id" type="var">Y</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<div class="togglescript" id="proofcontrol12" onclick="toggleDisplay('proof12');toggleDisplay('proofcontrol12')"><span class="show"></span></div>
<div class="proofscript" id="proof12" onclick="toggleDisplay('proof12');toggleDisplay('proofcontrol12')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;WORKED&nbsp;IN&nbsp;CLASS&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_if</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Then&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_pre</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_asgn</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">bassn</span>, <span class="id" type="var">assn_sub</span>, <span class="id" type="var">t_update</span>, <span class="id" type="var">assert_implies</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">simpl</span>. <span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> [<span class="id" type="var">_</span> <span class="id" type="var">H</span>].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">eqb_eq</span> <span class="id" type="keyword">in</span> <span class="id" type="var">H</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">rewrite</span> <span class="id" type="var">H</span>. <span class="id" type="tactic">omega</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Else&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_pre</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_asgn</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">assn_sub</span>, <span class="id" type="var">t_update</span>, <span class="id" type="var">assert_implies</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">simpl</span>; <span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> <span class="id" type="var">_</span>. <span class="id" type="tactic">omega</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
<a name="lab70"></a><h4 class="section">Exercise: 2 stars, standard (if_minus_plus)</h4>
 Prove the following hoare triple using <span class="inlinecode"><span class="id" type="var">hoare_if</span></span>.  Do not
    use <span class="inlinecode"><span class="id" type="tactic">unfold</span></span> <span class="inlinecode"><span class="id" type="var">hoare_triple</span></span>.  
</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">if_minus_plus</span> :<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">TEST</span> <span class="id" type="var">X</span> ≤ <span class="id" type="var">Y</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">THEN</span> <span class="id" type="var">Z</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Y</span> - <span class="id" type="var">X</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">ELSE</span> <span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> + <span class="id" type="var">Z</span><br/>
&nbsp;&nbsp;<span class="id" type="var">FI</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">st</span> <span class="id" type="var">Z</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 

<div class="doc">
<a name="lab71"></a><h3 class="section">Exercise: One-sided conditionals</h3>

<div class="paragraph"> </div>

<a name="lab72"></a><h4 class="section">Exercise: 4 stars, standard (if1_hoare)</h4>
 In this exercise we consider extending Imp with "one-sided
    conditionals" of the form <span class="inlinecode"><span class="id" type="var">IF<sub>1</sub></span></span> <span class="inlinecode"><span class="id" type="var">b</span></span> <span class="inlinecode"><span class="id" type="var">THEN</span></span> <span class="inlinecode"><span class="id" type="var">c</span></span> <span class="inlinecode"><span class="id" type="var">FI</span></span>. Here <span class="inlinecode"><span class="id" type="var">b</span></span> is a boolean
    expression, and <span class="inlinecode"><span class="id" type="var">c</span></span> is a command. If <span class="inlinecode"><span class="id" type="var">b</span></span> evaluates to <span class="inlinecode"><span class="id" type="var">true</span></span>, then
    command <span class="inlinecode"><span class="id" type="var">c</span></span> is evaluated. If <span class="inlinecode"><span class="id" type="var">b</span></span> evaluates to <span class="inlinecode"><span class="id" type="var">false</span></span>, then <span class="inlinecode"><span class="id" type="var">IF<sub>1</sub></span></span> <span class="inlinecode"><span class="id" type="var">b</span></span>
    <span class="inlinecode"><span class="id" type="var">THEN</span></span> <span class="inlinecode"><span class="id" type="var">c</span></span> <span class="inlinecode"><span class="id" type="var">FI</span></span> does nothing.

<div class="paragraph"> </div>

    We recommend that you complete this exercise before attempting the
    ones that follow, as it should help solidify your understanding of
    the material. 
<div class="paragraph"> </div>

 The first step is to extend the syntax of commands and introduce
    the usual notations.  (We've done this for you.  We use a separate
    module to prevent polluting the global name space.) 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Module</span> <span class="id" type="var">If<sub>1</sub></span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Inductive</span> <span class="id" type="var">com</span> : <span class="id" type="keyword">Type</span> :=<br/>
&nbsp;&nbsp;| <span class="id" type="var">CSkip</span> : <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CAss</span> : <span class="id" type="var">string</span> → <span class="id" type="var">aexp</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CSeq</span> : <span class="id" type="var">com</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CIf</span> : <span class="id" type="var">bexp</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CWhile</span> : <span class="id" type="var">bexp</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CIf1</span> : <span class="id" type="var">bexp</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Notation</span> "'SKIP'" :=<br/>
&nbsp;&nbsp;<span class="id" type="var">CSkip</span> : <span class="id" type="var">imp_scope</span>.<br/>
<span class="id" type="keyword">Notation</span> "c<sub>1</sub> ;; c<sub>2</sub>" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CSeq</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>) : <span class="id" type="var">imp_scope</span>.<br/>
<span class="id" type="keyword">Notation</span> "X '<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>' a" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CAss</span> <span class="id" type="var">X</span> <span class="id" type="var">a</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 60) : <span class="id" type="var">imp_scope</span>.<br/>
<span class="id" type="keyword">Notation</span> "'WHILE' b 'DO' c 'END'" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CWhile</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>) : <span class="id" type="var">imp_scope</span>.<br/>
<span class="id" type="keyword">Notation</span> "'TEST' e<sub>1</sub> 'THEN' e<sub>2</sub> 'ELSE' e<sub>3</sub> 'FI'" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CIf</span> <span class="id" type="var">e<sub>1</sub></span> <span class="id" type="var">e<sub>2</sub></span> <span class="id" type="var">e<sub>3</sub></span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>) : <span class="id" type="var">imp_scope</span>.<br/>
<span class="id" type="keyword">Notation</span> "'IF<sub>1</sub>' b 'THEN' c 'FI'" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CIf1</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>) : <span class="id" type="var">imp_scope</span>.<br/>
</div>

<div class="doc">
Next we need to extend the evaluation relation to accommodate
    <span class="inlinecode"><span class="id" type="var">IF<sub>1</sub></span></span> branches.  This is for you to do... What rule(s) need to be
    added to <span class="inlinecode"><span class="id" type="var">ceval</span></span> to evaluate one-sided conditionals? 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Reserved Notation</span> "st '=[' c ']⇒' st'" (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 40).<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Open</span> <span class="id" type="keyword">Scope</span> <span class="id" type="var">imp_scope</span>.<br/>
<span class="id" type="keyword">Inductive</span> <span class="id" type="var">ceval</span> : <span class="id" type="var">com</span> → <span class="id" type="var">state</span> → <span class="id" type="var">state</span> → <span class="id" type="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;| <span class="id" type="var">E_Skip</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">SKIP</span> ]⇒ <span class="id" type="var">st</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_Ass</span>  : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">a<sub>1</sub></span> <span class="id" type="var">n</span> <span class="id" type="var">x</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">aeval</span> <span class="id" type="var">st</span> <span class="id" type="var">a<sub>1</sub></span> = <span class="id" type="var">n</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">x</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">a<sub>1</sub></span> ]⇒ (<span class="id" type="var">x</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> <span class="id" type="var">n</span> ; <span class="id" type="var">st</span>)<br/>
&nbsp;&nbsp;| <span class="id" type="var">E_Seq</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">st''</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span>  =[ <span class="id" type="var">c<sub>1</sub></span> ]⇒ <span class="id" type="var">st'</span>  →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st'</span> =[ <span class="id" type="var">c<sub>2</sub></span> ]⇒ <span class="id" type="var">st''</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span>  =[ <span class="id" type="var">c<sub>1</sub></span> ;; <span class="id" type="var">c<sub>2</sub></span> ]⇒ <span class="id" type="var">st''</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_IfTrue</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">b</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">true</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">c<sub>1</sub></span> ]⇒ <span class="id" type="var">st'</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">TEST</span> <span class="id" type="var">b</span> <span class="id" type="var">THEN</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">ELSE</span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">FI</span> ]⇒ <span class="id" type="var">st'</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_IfFalse</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">b</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">false</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">c<sub>2</sub></span> ]⇒ <span class="id" type="var">st'</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">TEST</span> <span class="id" type="var">b</span> <span class="id" type="var">THEN</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">ELSE</span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">FI</span> ]⇒ <span class="id" type="var">st'</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_WhileFalse</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">b</span> <span class="id" type="var">st</span> <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">false</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span> ]⇒ <span class="id" type="var">st</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_WhileTrue</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">st''</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">true</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span>  =[ <span class="id" type="var">c</span> ]⇒ <span class="id" type="var">st'</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st'</span> =[ <span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span> ]⇒ <span class="id" type="var">st''</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span>  =[ <span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span> ]⇒ <span class="id" type="var">st''</span><br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
<br/>
&nbsp;&nbsp;<span class="id" type="keyword">where</span> "st '=[' c ']⇒' st'" := (<span class="id" type="var">ceval</span> <span class="id" type="var">c</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span>).<br/>
<span class="id" type="var">Close</span> <span class="id" type="keyword">Scope</span> <span class="id" type="var">imp_scope</span>.<br/>
</div>

<div class="doc">
Now we repeat (verbatim) the definition and notation of Hoare triples. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">hoare_triple</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">P</span> : <span class="id" type="var">Assertion</span>) (<span class="id" type="var">c</span> : <span class="id" type="var">com</span>) (<span class="id" type="var">Q</span> : <span class="id" type="var">Assertion</span>) : <span class="id" type="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">st'</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">c</span> ]⇒ <span class="id" type="var">st'</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">P</span> <span class="id" type="var">st</span>  →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Q</span> <span class="id" type="var">st'</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Notation</span> "<span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}  c  <span style='letter-spacing:-.4em;'>{</span>{ Q <span style='letter-spacing:-.4em;'>}</span>}" := (<span class="id" type="var">hoare_triple</span> <span class="id" type="var">P</span> <span class="id" type="var">c</span> <span class="id" type="var">Q</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 90, <span class="id" type="var">c</span> <span class="id" type="tactic">at</span> <span class="id" type="var">next</span> <span class="id" type="var">level</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: <span class="id" type="var">hoare_spec_scope</span>.<br/>
</div>

<div class="doc">
Finally, we (i.e., you) need to state and prove a theorem,
    <span class="inlinecode"><span class="id" type="var">hoare_if<sub>1</sub></span></span>, that expresses an appropriate Hoare logic proof rule
    for one-sided conditionals. Try to come up with a rule that is
    both sound and as precise as possible. 
</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
</div>

<div class="doc">
For full credit, prove formally <span class="inlinecode"><span class="id" type="var">hoare_if1_good</span></span> that your rule is
    precise enough to show the following valid Hoare triple:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;<span class="id" type="var">Y</span>&nbsp;=&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">IF<sub>1</sub></span>&nbsp;~(<span class="id" type="var">Y</span>&nbsp;=&nbsp;0)&nbsp;<span class="id" type="var">THEN</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;+&nbsp;<span class="id" type="var">Y</span><br/>
&nbsp;&nbsp;<span class="id" type="var">FI</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;<span class="id" type="var">Z</span>&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

<div class="paragraph"> </div>

 Hint: Your proof of this triple may need to use the other proof
    rules also. Because we're working in a separate module, you'll
    need to copy here the rules you find necessary. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Lemma</span> <span class="id" type="var">hoare_if1_good</span> :<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> + <span class="id" type="var">st</span> <span class="id" type="var">Y</span> = <span class="id" type="var">st</span> <span class="id" type="var">Z</span> <span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;(<span class="id" type="var">IF<sub>1</sub></span> ~(<span class="id" type="var">Y</span> = 0) <span class="id" type="var">THEN</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> + <span class="id" type="var">Y</span><br/>
&nbsp;&nbsp;<span class="id" type="var">FI</span>)%<span class="id" type="var">imp</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = <span class="id" type="var">st</span> <span class="id" type="var">Z</span> <span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>. <span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">End</span> <span class="id" type="var">If<sub>1</sub></span>.<br/><hr class='doublespaceincode'/>
<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">manual_grade_for_if1_hoare</span> : <span class="id" type="var">option</span> (<span class="id" type="var">nat</span>*<span class="id" type="var">string</span>) := <span class="id" type="var">None</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 

<div class="doc">
<a name="lab73"></a><h2 class="section">Loops</h2>

<div class="paragraph"> </div>

 Finally, we need a rule for reasoning about while loops. 
<div class="paragraph"> </div>

 Suppose we have a loop

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;<span class="id" type="var">b</span>&nbsp;<span class="id" type="var">DO</span>&nbsp;<span class="id" type="var">c</span>&nbsp;<span class="id" type="var">END</span>
<div class="paragraph"> </div>

</div>
    and we want to find a precondition <span class="inlinecode"><span class="id" type="var">P</span></span> and a postcondition
    <span class="inlinecode"><span class="id" type="var">Q</span></span> such that

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">WHILE</span>&nbsp;<span class="id" type="var">b</span>&nbsp;<span class="id" type="var">DO</span>&nbsp;<span class="id" type="var">c</span>&nbsp;<span class="id" type="var">END</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>
    is a valid triple. 
<div class="paragraph"> </div>

 First of all, let's think about the case where <span class="inlinecode"><span class="id" type="var">b</span></span> is false at the
    beginning &mdash; i.e., let's assume that the loop body never executes
    at all.  In this case, the loop behaves like <span class="inlinecode"><span class="id" type="var">SKIP</span></span>, so we might
    be tempted to write: 
<div class="paragraph"> </div>


<div class="paragraph"> </div>


<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">WHILE</span>&nbsp;<span class="id" type="var">b</span>&nbsp;<span class="id" type="var">DO</span>&nbsp;<span class="id" type="var">c</span>&nbsp;<span class="id" type="var">END</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>}.
<div class="paragraph"> </div>

</div>

<div class="paragraph"> </div>

 But, as we remarked above for the conditional, we know a
    little more at the end &mdash; not just <span class="inlinecode"><span class="id" type="var">P</span></span>, but also the fact
    that <span class="inlinecode"><span class="id" type="var">b</span></span> is false in the current state.  So we can enrich the
    postcondition a little: 
<div class="paragraph"> </div>


<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>}&nbsp;<span class="id" type="var">WHILE</span>&nbsp;<span class="id" type="var">b</span>&nbsp;<span class="id" type="var">DO</span>&nbsp;<span class="id" type="var">c</span>&nbsp;<span class="id" type="var">END</span>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span>&nbsp;∧&nbsp;¬<span class="id" type="var">b</span><span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

<div class="paragraph"> </div>

 What about the case where the loop body <i>does</i> get executed?
    In order to ensure that <span class="inlinecode"><span class="id" type="var">P</span></span> holds when the loop finally
    exits, we certainly need to make sure that the command <span class="inlinecode"><span class="id" type="var">c</span></span>
    guarantees that <span class="inlinecode"><span class="id" type="var">P</span></span> holds whenever <span class="inlinecode"><span class="id" type="var">c</span></span> is finished.
    Moreover, since <span class="inlinecode"><span class="id" type="var">P</span></span> holds at the beginning of the first
    execution of <span class="inlinecode"><span class="id" type="var">c</span></span>, and since each execution of <span class="inlinecode"><span class="id" type="var">c</span></span>
    re-establishes <span class="inlinecode"><span class="id" type="var">P</span></span> when it finishes, we can always assume
    that <span class="inlinecode"><span class="id" type="var">P</span></span> holds at the beginning of <span class="inlinecode"><span class="id" type="var">c</span></span>.  This leads us to the
    following rule: 
<div class="paragraph"> </div>

<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c&nbsp;<span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td class="infrulenamecol" rowspan="3">
    &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}&nbsp;WHILE&nbsp;b&nbsp;DO&nbsp;c&nbsp;END&nbsp;<span style='letter-spacing:-.4em;'>{</span>{P&nbsp;∧&nbsp;¬b<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center> This is almost the rule we want, but again it can be improved a
    little: at the beginning of the loop body, we know not only that
    <span class="inlinecode"><span class="id" type="var">P</span></span> holds, but also that the guard <span class="inlinecode"><span class="id" type="var">b</span></span> is true in the current
    state. 
<div class="paragraph"> </div>

 This gives us a little more information to use in reasoning
    about <span class="inlinecode"><span class="id" type="var">c</span></span> (showing that it establishes the invariant by the time
    it finishes).   And this leads us to the final version of the rule: 
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P&nbsp;∧&nbsp;b<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c&nbsp;<span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_while) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}&nbsp;WHILE&nbsp;b&nbsp;DO&nbsp;c&nbsp;END&nbsp;<span style='letter-spacing:-.4em;'>{</span>{P&nbsp;∧&nbsp;¬b<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>    The proposition <span class="inlinecode"><span class="id" type="var">P</span></span> is called an <i>invariant</i> of the loop.

</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_while</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">P</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">P</span> <span class="id" type="var">st</span> ∧ <span class="id" type="var">bassn</span> <span class="id" type="var">b</span> <span class="id" type="var">st</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">P</span> <span class="id" type="var">st</span> ∧ ¬(<span class="id" type="var">bassn</span> <span class="id" type="var">b</span> <span class="id" type="var">st</span>)<span style='letter-spacing:-.4em;'>}</span>}.<br/>
<div class="togglescript" id="proofcontrol13" onclick="toggleDisplay('proof13');toggleDisplay('proofcontrol13')"><span class="show"></span></div>
<div class="proofscript" id="proof13" onclick="toggleDisplay('proof13');toggleDisplay('proofcontrol13')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span> <span class="id" type="var">Hhoare</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">He</span> <span class="id" type="var">HP</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;Like&nbsp;we've&nbsp;seen&nbsp;before,&nbsp;we&nbsp;need&nbsp;to&nbsp;reason&nbsp;by&nbsp;induction<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;on&nbsp;<span class="inlinecode"><span class="id" type="var">He</span></span>,&nbsp;because,&nbsp;in&nbsp;the&nbsp;"keep&nbsp;looping"&nbsp;case,&nbsp;its&nbsp;hypotheses<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;talk&nbsp;about&nbsp;the&nbsp;whole&nbsp;loop&nbsp;instead&nbsp;of&nbsp;just&nbsp;<span class="inlinecode"><span class="id" type="var">c</span></span>.&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="id" type="var">remember</span> (<span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span>)%<span class="id" type="var">imp</span> <span class="id" type="keyword">as</span> <span class="id" type="var">wcom</span> <span class="id" type="var">eqn</span>:<span class="id" type="var">Heqwcom</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">induction</span> <span class="id" type="var">He</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">try</span> (<span class="id" type="tactic">inversion</span> <span class="id" type="var">Heqwcom</span>); <span class="id" type="tactic">subst</span>; <span class="id" type="tactic">clear</span> <span class="id" type="var">Heqwcom</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;E_WhileFalse&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">split</span>. <span class="id" type="tactic">assumption</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">bexp_eval_false</span>. <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;E_WhileTrue&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">IHHe2</span>. <span class="id" type="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> (<span class="id" type="var">Hhoare</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span>). <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">split</span>. <span class="id" type="tactic">assumption</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">bexp_eval_true</span>. <span class="id" type="tactic">assumption</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
One subtlety in the terminology is that calling some assertion <span class="inlinecode"><span class="id" type="var">P</span></span>
    a "loop invariant" doesn't just mean that it is preserved by the
    body of the loop in question (i.e., <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode"><span class="id" type="var">c</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>}</span>, where <span class="inlinecode"><span class="id" type="var">c</span></span> is
    the loop body), but rather that <span class="inlinecode"><span class="id" type="var">P</span></span> <i>together with the fact that
    the loop's guard is true</i> is a sufficient precondition for <span class="inlinecode"><span class="id" type="var">c</span></span> to
    ensure <span class="inlinecode"><span class="id" type="var">P</span></span> as a postcondition.

<div class="paragraph"> </div>

    This is a slightly (but importantly) weaker requirement.  For
    example, if <span class="inlinecode"><span class="id" type="var">P</span></span> is the assertion <span class="inlinecode"><span class="id" type="var">X</span></span> <span class="inlinecode">=</span> <span class="inlinecode">0</span>, then <span class="inlinecode"><span class="id" type="var">P</span></span> <i>is</i> an
    invariant of the loop

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">WHILE</span>&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;2&nbsp;<span class="id" type="var">DO</span>&nbsp;<span class="id" type="var">X</span>&nbsp;:=&nbsp;1&nbsp;<span class="id" type="var">END</span>
<div class="paragraph"> </div>

</div>
    although it is clearly <i>not</i> preserved by the body of the
    loop. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Example</span> <span class="id" type="var">while_example</span> :<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> ≤ 3<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">WHILE</span> <span class="id" type="var">X</span> ≤ 2<br/>
&nbsp;&nbsp;<span class="id" type="var">DO</span> <span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> + 1 <span class="id" type="var">END</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">st</span> <span class="id" type="var">X</span> = 3<span style='letter-spacing:-.4em;'>}</span>}.<br/>
<div class="togglescript" id="proofcontrol14" onclick="toggleDisplay('proof14');toggleDisplay('proofcontrol14')"><span class="show"></span></div>
<div class="proofscript" id="proof14" onclick="toggleDisplay('proof14');toggleDisplay('proofcontrol14')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_post</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_while</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_pre</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_asgn</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">bassn</span>, <span class="id" type="var">assn_sub</span>, <span class="id" type="var">assert_implies</span>, <span class="id" type="var">t_update</span>. <span class="id" type="tactic">simpl</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> [<span class="id" type="var">H<sub>1</sub></span> <span class="id" type="var">H<sub>2</sub></span>]. <span class="id" type="tactic">apply</span> <span class="id" type="var">leb_complete</span> <span class="id" type="keyword">in</span> <span class="id" type="var">H<sub>2</sub></span>. <span class="id" type="tactic">omega</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">bassn</span>, <span class="id" type="var">assert_implies</span>. <span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> [<span class="id" type="var">Hle</span> <span class="id" type="var">Hb</span>].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">simpl</span> <span class="id" type="keyword">in</span> <span class="id" type="var">Hb</span>. <span class="id" type="tactic">destruct</span> ((<span class="id" type="var">st</span> <span class="id" type="var">X</span>) &lt;=? 2) <span class="id" type="var">eqn</span> : <span class="id" type="var">Heqle</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">exfalso</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">Hb</span>; <span class="id" type="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">leb_iff_conv</span> <span class="id" type="keyword">in</span> <span class="id" type="var">Heqle</span>. <span class="id" type="tactic">omega</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
We can use the WHILE rule to prove the following Hoare triple... 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">always_loop_hoare</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">P</span> <span class="id" type="var">Q</span>,<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">WHILE</span> <span class="id" type="var">true</span> <span class="id" type="var">DO</span> <span class="id" type="var">SKIP</span> <span class="id" type="var">END</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<div class="togglescript" id="proofcontrol15" onclick="toggleDisplay('proof15');toggleDisplay('proofcontrol15')"><span class="show"></span></div>
<div class="proofscript" id="proof15" onclick="toggleDisplay('proof15');toggleDisplay('proofcontrol15')">
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;WORKED&nbsp;IN&nbsp;CLASS&nbsp;*)</span><br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">Q</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_consequence_pre</span> <span class="id" type="keyword">with</span> (<span class="id" type="var">P'</span> := <span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> : <span class="id" type="var">state</span> ⇒ <span class="id" type="var">True</span>).<br/>
&nbsp;&nbsp;<span class="id" type="tactic">eapply</span> <span class="id" type="var">hoare_consequence_post</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_while</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Loop&nbsp;body&nbsp;preserves&nbsp;invariant&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">hoare_post_true</span>. <span class="id" type="tactic">intros</span> <span class="id" type="var">st</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">I</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Loop&nbsp;invariant&nbsp;and&nbsp;negated&nbsp;guard&nbsp;imply&nbsp;postcondition&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">simpl</span>. <span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> [<span class="id" type="var">Hinv</span> <span class="id" type="var">Hguard</span>].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">exfalso</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">Hguard</span>. <span class="id" type="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Precondition&nbsp;implies&nbsp;invariant&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> <span class="id" type="var">H</span>. <span class="id" type="var">constructor</span>. <span class="id" type="keyword">Qed</span>.<br/>
</div>
</div>

<div class="doc">
Of course, this result is not surprising if we remember that
    the definition of <span class="inlinecode"><span class="id" type="var">hoare_triple</span></span> asserts that the postcondition
    must hold <i>only</i> when the command terminates.  If the command
    doesn't terminate, we can prove anything we like about the
    postcondition. 
<div class="paragraph"> </div>

 Hoare rules that only talk about what happens when commands
    terminate (without proving that they do) are often said to
    describe a logic of "partial" correctness.  It is also possible to
    give Hoare rules for "total" correctness, which build in the fact
    that the commands terminate. However, in this course we will only
    talk about partial correctness. 
</div>

<div class="doc">
<a name="lab74"></a><h3 class="section">Exercise: <span class="inlinecode"><span class="id" type="var">REPEAT</span></span></h3>

<div class="paragraph"> </div>

<a name="lab75"></a><h4 class="section">Exercise: 4 stars, advanced (hoare_repeat)</h4>
 In this exercise, we'll add a new command to our language of
    commands: <span class="inlinecode"><span class="id" type="var">REPEAT</span></span> c <span class="inlinecode"><span class="id" type="var">UNTIL</span></span> b <span class="inlinecode"><span class="id" type="var">END</span></span>. You will write the
    evaluation rule for <span class="inlinecode"><span class="id" type="var">REPEAT</span></span> and add a new Hoare rule to the
    language for programs involving it.  (You may recall that the
    evaluation rule is given in an example in the <a href="https://www.cis.upenn.edu/~bcpierce/sf/lf-current/Auto.html"><span class="inlineref">Auto</span></a> chapter.
    Try to figure it out yourself here rather than peeking.) 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Module</span> <span class="id" type="var">RepeatExercise</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Inductive</span> <span class="id" type="var">com</span> : <span class="id" type="keyword">Type</span> :=<br/>
&nbsp;&nbsp;| <span class="id" type="var">CSkip</span> : <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CAsgn</span> : <span class="id" type="var">string</span> → <span class="id" type="var">aexp</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CSeq</span> : <span class="id" type="var">com</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CIf</span> : <span class="id" type="var">bexp</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CWhile</span> : <span class="id" type="var">bexp</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CRepeat</span> : <span class="id" type="var">com</span> → <span class="id" type="var">bexp</span> → <span class="id" type="var">com</span>.<br/>
</div>

<div class="doc">
<span class="inlinecode"><span class="id" type="var">REPEAT</span></span> behaves like <span class="inlinecode"><span class="id" type="var">WHILE</span></span>, except that the loop guard is
    checked <i>after</i> each execution of the body, with the loop
    repeating as long as the guard stays <i>false</i>.  Because of this,
    the body will always execute at least once. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Notation</span> "'SKIP'" :=<br/>
&nbsp;&nbsp;<span class="id" type="var">CSkip</span>.<br/>
<span class="id" type="keyword">Notation</span> "c<sub>1</sub> ;; c<sub>2</sub>" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CSeq</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>).<br/>
<span class="id" type="keyword">Notation</span> "X '<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>' a" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CAsgn</span> <span class="id" type="var">X</span> <span class="id" type="var">a</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 60).<br/>
<span class="id" type="keyword">Notation</span> "'WHILE' b 'DO' c 'END'" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CWhile</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>).<br/>
<span class="id" type="keyword">Notation</span> "'TEST' e<sub>1</sub> 'THEN' e<sub>2</sub> 'ELSE' e<sub>3</sub> 'FI'" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CIf</span> <span class="id" type="var">e<sub>1</sub></span> <span class="id" type="var">e<sub>2</sub></span> <span class="id" type="var">e<sub>3</sub></span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>).<br/>
<span class="id" type="keyword">Notation</span> "'REPEAT' e<sub>1</sub> 'UNTIL' b<sub>2</sub> 'END'" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CRepeat</span> <span class="id" type="var">e<sub>1</sub></span> <span class="id" type="var">b<sub>2</sub></span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>).<br/>
</div>

<div class="doc">
Add new rules for <span class="inlinecode"><span class="id" type="var">REPEAT</span></span> to <span class="inlinecode"><span class="id" type="var">ceval</span></span> below.  You can use the rules
    for <span class="inlinecode"><span class="id" type="var">WHILE</span></span> as a guide, but remember that the body of a <span class="inlinecode"><span class="id" type="var">REPEAT</span></span>
    should always execute at least once, and that the loop ends when
    the guard becomes true. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Reserved Notation</span> "st '=[' c ']⇒' st'" (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 40).<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Inductive</span> <span class="id" type="var">ceval</span> : <span class="id" type="var">state</span> → <span class="id" type="var">com</span> → <span class="id" type="var">state</span> → <span class="id" type="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;| <span class="id" type="var">E_Skip</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">SKIP</span> ]⇒ <span class="id" type="var">st</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_Ass</span>  : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">a<sub>1</sub></span> <span class="id" type="var">n</span> <span class="id" type="var">x</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">aeval</span> <span class="id" type="var">st</span> <span class="id" type="var">a<sub>1</sub></span> = <span class="id" type="var">n</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">x</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">a<sub>1</sub></span> ]⇒ (<span class="id" type="var">x</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> <span class="id" type="var">n</span> ; <span class="id" type="var">st</span>)<br/>
&nbsp;&nbsp;| <span class="id" type="var">E_Seq</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">st''</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span>  =[ <span class="id" type="var">c<sub>1</sub></span> ]⇒ <span class="id" type="var">st'</span>  →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st'</span> =[ <span class="id" type="var">c<sub>2</sub></span> ]⇒ <span class="id" type="var">st''</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span>  =[ <span class="id" type="var">c<sub>1</sub></span> ;; <span class="id" type="var">c<sub>2</sub></span> ]⇒ <span class="id" type="var">st''</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_IfTrue</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">b</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">true</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">c<sub>1</sub></span> ]⇒ <span class="id" type="var">st'</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">TEST</span> <span class="id" type="var">b</span> <span class="id" type="var">THEN</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">ELSE</span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">FI</span> ]⇒ <span class="id" type="var">st'</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_IfFalse</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">b</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">false</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">c<sub>2</sub></span> ]⇒ <span class="id" type="var">st'</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">TEST</span> <span class="id" type="var">b</span> <span class="id" type="var">THEN</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">ELSE</span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">FI</span> ]⇒ <span class="id" type="var">st'</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_WhileFalse</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">b</span> <span class="id" type="var">st</span> <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">false</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span> ]⇒ <span class="id" type="var">st</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_WhileTrue</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">st''</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">true</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span>  =[ <span class="id" type="var">c</span> ]⇒ <span class="id" type="var">st'</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st'</span> =[ <span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span> ]⇒ <span class="id" type="var">st''</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span>  =[ <span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span> ]⇒ <span class="id" type="var">st''</span><br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
<br/>
<span class="id" type="keyword">where</span> "st '=[' c ']⇒' st'" := (<span class="id" type="var">ceval</span> <span class="id" type="var">st</span> <span class="id" type="var">c</span> <span class="id" type="var">st'</span>).<br/>
</div>

<div class="doc">
A couple of definitions from above, copied here so they use the
    new <span class="inlinecode"><span class="id" type="var">ceval</span></span>. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">hoare_triple</span> (<span class="id" type="var">P</span> : <span class="id" type="var">Assertion</span>) (<span class="id" type="var">c</span> : <span class="id" type="var">com</span>) (<span class="id" type="var">Q</span> : <span class="id" type="var">Assertion</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: <span class="id" type="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">st'</span>, <span class="id" type="var">st</span> =[ <span class="id" type="var">c</span> ]⇒ <span class="id" type="var">st'</span> → <span class="id" type="var">P</span> <span class="id" type="var">st</span> → <span class="id" type="var">Q</span> <span class="id" type="var">st'</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Notation</span> "<span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}  c  <span style='letter-spacing:-.4em;'>{</span>{ Q <span style='letter-spacing:-.4em;'>}</span>}" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">hoare_triple</span> <span class="id" type="var">P</span> <span class="id" type="var">c</span> <span class="id" type="var">Q</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 90, <span class="id" type="var">c</span> <span class="id" type="tactic">at</span> <span class="id" type="var">next</span> <span class="id" type="var">level</span>).<br/>
</div>

<div class="doc">
To make sure you've got the evaluation rules for <span class="inlinecode"><span class="id" type="var">REPEAT</span></span> right,
    prove that <span class="inlinecode"><span class="id" type="var">ex1_repeat</span></span> evaluates correctly. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">ex1_repeat</span> :=<br/>
&nbsp;&nbsp;<span class="id" type="var">REPEAT</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> 1;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">Y</span> + 1<br/>
&nbsp;&nbsp;<span class="id" type="var">UNTIL</span> <span class="id" type="var">X</span> = 1 <span class="id" type="var">END</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">ex1_repeat_works</span> :<br/>
&nbsp;&nbsp;<span class="id" type="var">empty_st</span> =[ <span class="id" type="var">ex1_repeat</span> ]⇒ (<span class="id" type="var">Y</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> 1 ; <span class="id" type="var">X</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> 1).<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/>
</div>

<div class="doc">
Now state and prove a theorem, <span class="inlinecode"><span class="id" type="var">hoare_repeat</span></span>, that expresses an
    appropriate proof rule for <span class="inlinecode"><span class="id" type="tactic">repeat</span></span> commands.  Use <span class="inlinecode"><span class="id" type="var">hoare_while</span></span>
    as a model, and try to make your rule as precise as possible. 
</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
</div>

<div class="doc">
For full credit, make sure (informally) that your rule can be used
    to prove the following valid Hoare triple:

<div class="paragraph"> </div>

<div class="code code-tight">
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;&gt;&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">REPEAT</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">Y</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>;;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">X</span>&nbsp;<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>&nbsp;<span class="id" type="var">X</span>&nbsp;-&nbsp;1<br/>
&nbsp;&nbsp;<span class="id" type="var">UNTIL</span>&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;0&nbsp;<span class="id" type="var">END</span><br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;<span class="id" type="var">X</span>&nbsp;=&nbsp;0&nbsp;∧&nbsp;<span class="id" type="var">Y</span>&nbsp;&gt;&nbsp;0&nbsp;<span style='letter-spacing:-.4em;'>}</span>}
<div class="paragraph"> </div>

</div>

</div>
<div class="code code-tight">

<span class="id" type="keyword">End</span> <span class="id" type="var">RepeatExercise</span>.<br/><hr class='doublespaceincode'/>
<span class="comment">(*&nbsp;Do&nbsp;not&nbsp;modify&nbsp;the&nbsp;following&nbsp;line:&nbsp;*)</span><br/>
<span class="id" type="keyword">Definition</span> <span class="id" type="var">manual_grade_for_hoare_repeat</span> : <span class="id" type="var">option</span> (<span class="id" type="var">nat</span>*<span class="id" type="var">string</span>) := <span class="id" type="var">None</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 

<div class="doc">
<a name="lab76"></a><h1 class="section">Summary</h1>

<div class="paragraph"> </div>

 So far, we've introduced Hoare Logic as a tool for reasoning about
    Imp programs. The rules of Hoare Logic are:
<center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule">&nbsp;&nbsp;</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_asgn) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{Q&nbsp;[X&nbsp;<span class="nowrap"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span></span>&nbsp;a]<span style='letter-spacing:-.4em;'>}</span>}&nbsp;X<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>a&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center><center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule">&nbsp;&nbsp;</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_skip) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{&nbsp;P&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;SKIP&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;P&nbsp;<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center><center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{&nbsp;P&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c<sub>1</sub>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;Q&nbsp;<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{&nbsp;Q&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c<sub>2</sub>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;R&nbsp;<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_seq) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{&nbsp;P&nbsp;<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c<sub>1</sub>;;c<sub>2</sub>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{&nbsp;R&nbsp;<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center><center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P&nbsp;∧&nbsp;&nbsp;&nbsp;b<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c<sub>1</sub>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P&nbsp;∧&nbsp;¬b<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c<sub>2</sub>&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_if) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}&nbsp;TEST&nbsp;b&nbsp;THEN&nbsp;c<sub>1</sub>&nbsp;ELSE&nbsp;c<sub>2</sub>&nbsp;FI&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center><center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P&nbsp;∧&nbsp;b<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c&nbsp;<span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_while) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}&nbsp;WHILE&nbsp;b&nbsp;DO&nbsp;c&nbsp;END&nbsp;<span style='letter-spacing:-.4em;'>{</span>{P&nbsp;∧&nbsp;¬b<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center><center><table class="infrule">
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P'<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q'<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">P&nbsp;<span class="nowrap"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span>&nbsp;P'</td>
  <td></td>
</td>
<tr class="infruleassumption">
  <td class="infrule">Q'&nbsp;<span class="nowrap"><span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span></span>&nbsp;Q</td>
  <td class="infrulenamecol" rowspan="3">
    (hoare_consequence) &nbsp;
  </td></tr>
<tr class="infrulemiddle">
  <td class="infrule"><hr /></td>
</tr>
<tr class="infruleassumption">
  <td class="infrule"><span style='letter-spacing:-.4em;'>{</span>{P<span style='letter-spacing:-.4em;'>}</span>}&nbsp;c&nbsp;<span style='letter-spacing:-.4em;'>{</span>{Q<span style='letter-spacing:-.4em;'>}</span>}</td>
  <td></td>
</td>
</table></center>    In the next chapter, we'll see how these rules are used to prove
    that programs satisfy specifications of their behavior. 
</div>

<div class="doc">
<a name="lab77"></a><h1 class="section">Additional Exercises</h1>

<div class="paragraph"> </div>

<a name="lab78"></a><h4 class="section">Exercise: 3 stars, standard (hoare_havoc)</h4>
 In this exercise, we will derive proof rules for a <span class="inlinecode"><span class="id" type="var">HAVOC</span></span>
    command, which is similar to the nondeterministic <span class="inlinecode"><span class="id" type="var">any</span></span> expression
    from the the <a href="Imp.html"><span class="inlineref">Imp</span></a> chapter.

<div class="paragraph"> </div>

    First, we enclose this work in a separate module, and recall the
    syntax and big-step semantics of Himp commands. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Module</span> <span class="id" type="var">Himp</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Inductive</span> <span class="id" type="var">com</span> : <span class="id" type="keyword">Type</span> :=<br/>
&nbsp;&nbsp;| <span class="id" type="var">CSkip</span> : <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CAsgn</span> : <span class="id" type="var">string</span> → <span class="id" type="var">aexp</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CSeq</span> : <span class="id" type="var">com</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CIf</span> : <span class="id" type="var">bexp</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CWhile</span> : <span class="id" type="var">bexp</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CHavoc</span> : <span class="id" type="var">string</span> → <span class="id" type="var">com</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Notation</span> "'SKIP'" :=<br/>
&nbsp;&nbsp;<span class="id" type="var">CSkip</span>.<br/>
<span class="id" type="keyword">Notation</span> "X '<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>' a" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CAsgn</span> <span class="id" type="var">X</span> <span class="id" type="var">a</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 60).<br/>
<span class="id" type="keyword">Notation</span> "c<sub>1</sub> ;; c<sub>2</sub>" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CSeq</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>).<br/>
<span class="id" type="keyword">Notation</span> "'WHILE' b 'DO' c 'END'" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CWhile</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>).<br/>
<span class="id" type="keyword">Notation</span> "'TEST' e<sub>1</sub> 'THEN' e<sub>2</sub> 'ELSE' e<sub>3</sub> 'FI'" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CIf</span> <span class="id" type="var">e<sub>1</sub></span> <span class="id" type="var">e<sub>2</sub></span> <span class="id" type="var">e<sub>3</sub></span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>).<br/>
<span class="id" type="keyword">Notation</span> "'HAVOC' X" := (<span class="id" type="var">CHavoc</span> <span class="id" type="var">X</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 60).<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Reserved Notation</span> "st '=[' c ']⇒' st'" (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 40).<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Inductive</span> <span class="id" type="var">ceval</span> : <span class="id" type="var">com</span> → <span class="id" type="var">state</span> → <span class="id" type="var">state</span> → <span class="id" type="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;| <span class="id" type="var">E_Skip</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">SKIP</span> ]⇒ <span class="id" type="var">st</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_Ass</span>  : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">a<sub>1</sub></span> <span class="id" type="var">n</span> <span class="id" type="var">x</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">aeval</span> <span class="id" type="var">st</span> <span class="id" type="var">a<sub>1</sub></span> = <span class="id" type="var">n</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">x</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">a<sub>1</sub></span> ]⇒ (<span class="id" type="var">x</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> <span class="id" type="var">n</span> ; <span class="id" type="var">st</span>)<br/>
&nbsp;&nbsp;| <span class="id" type="var">E_Seq</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">st''</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span>  =[ <span class="id" type="var">c<sub>1</sub></span> ]⇒ <span class="id" type="var">st'</span>  →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st'</span> =[ <span class="id" type="var">c<sub>2</sub></span> ]⇒ <span class="id" type="var">st''</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span>  =[ <span class="id" type="var">c<sub>1</sub></span> ;; <span class="id" type="var">c<sub>2</sub></span> ]⇒ <span class="id" type="var">st''</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_IfTrue</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">b</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">true</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">c<sub>1</sub></span> ]⇒ <span class="id" type="var">st'</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">TEST</span> <span class="id" type="var">b</span> <span class="id" type="var">THEN</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">ELSE</span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">FI</span> ]⇒ <span class="id" type="var">st'</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_IfFalse</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">b</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">false</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">c<sub>2</sub></span> ]⇒ <span class="id" type="var">st'</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">TEST</span> <span class="id" type="var">b</span> <span class="id" type="var">THEN</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">ELSE</span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">FI</span> ]⇒ <span class="id" type="var">st'</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_WhileFalse</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">b</span> <span class="id" type="var">st</span> <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">false</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span> ]⇒ <span class="id" type="var">st</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_WhileTrue</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">st''</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">true</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span>  =[ <span class="id" type="var">c</span> ]⇒ <span class="id" type="var">st'</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st'</span> =[ <span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span> ]⇒ <span class="id" type="var">st''</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span>  =[ <span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span> ]⇒ <span class="id" type="var">st''</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_Havoc</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">X</span> <span class="id" type="var">n</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">HAVOC</span> <span class="id" type="var">X</span> ]⇒ (<span class="id" type="var">X</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> <span class="id" type="var">n</span> ; <span class="id" type="var">st</span>)<br/>
<br/>
<span class="id" type="keyword">where</span> "st '=[' c ']⇒' st'" := (<span class="id" type="var">ceval</span> <span class="id" type="var">c</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span>).<br/>
</div>

<div class="doc">
The definition of Hoare triples is exactly as before. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">hoare_triple</span> (<span class="id" type="var">P</span>:<span class="id" type="var">Assertion</span>) (<span class="id" type="var">c</span>:<span class="id" type="var">com</span>) (<span class="id" type="var">Q</span>:<span class="id" type="var">Assertion</span>) : <span class="id" type="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">st'</span>, <span class="id" type="var">st</span> =[ <span class="id" type="var">c</span> ]⇒ <span class="id" type="var">st'</span> → <span class="id" type="var">P</span> <span class="id" type="var">st</span> → <span class="id" type="var">Q</span> <span class="id" type="var">st'</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Notation</span> "<span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}  c  <span style='letter-spacing:-.4em;'>{</span>{ Q <span style='letter-spacing:-.4em;'>}</span>}" := (<span class="id" type="var">hoare_triple</span> <span class="id" type="var">P</span> <span class="id" type="var">c</span> <span class="id" type="var">Q</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 90, <span class="id" type="var">c</span> <span class="id" type="tactic">at</span> <span class="id" type="var">next</span> <span class="id" type="var">level</span>)<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: <span class="id" type="var">hoare_spec_scope</span>.<br/>
</div>

<div class="doc">
Complete the Hoare rule for <span class="inlinecode"><span class="id" type="var">HAVOC</span></span> commands below by defining
    <span class="inlinecode"><span class="id" type="var">havoc_pre</span></span> and prove that the resulting rule is correct. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">havoc_pre</span> (<span class="id" type="var">X</span> : <span class="id" type="var">string</span>) (<span class="id" type="var">Q</span> : <span class="id" type="var">Assertion</span>) : <span class="id" type="var">Assertion</span><br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;REPLACE&nbsp;THIS&nbsp;LINE&nbsp;WITH&nbsp;":=&nbsp;_your_definition_&nbsp;."&nbsp;*)</span>. <span class="id" type="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_havoc</span> : <span style='font-size:120%;'>&forall;</span>(<span class="id" type="var">Q</span> : <span class="id" type="var">Assertion</span>) (<span class="id" type="var">X</span> : <span class="id" type="var">string</span>),<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="var">havoc_pre</span> <span class="id" type="var">X</span> <span class="id" type="var">Q</span> <span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">HAVOC</span> <span class="id" type="var">X</span> <span style='letter-spacing:-.4em;'>{</span>{ <span class="id" type="var">Q</span> <span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">End</span> <span class="id" type="var">Himp</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="doc less-space">
<div class="paragraph"> </div>

<a name="lab79"></a><h4 class="section">Exercise: 4 stars, standard, optional (assert_vs_assume)</h4>

</div>
<div class="code code-space">

<br/>
<span class="id" type="keyword">Module</span> <span class="id" type="var">HoareAssertAssume</span>.<br/>
</div>

<div class="doc">
In this exercise, we will extend IMP with two commands,
     <span class="inlinecode"><span class="id" type="var">ASSERT</span></span> and <span class="inlinecode"><span class="id" type="var">ASSUME</span></span>. Both commands are ways
     to indicate that a certain statement should hold any time this part
     of the program is reached. However they differ as follows:

<div class="paragraph"> </div>

<ul class="doclist">
<li> If an <span class="inlinecode"><span class="id" type="var">ASSERT</span></span> statement fails, it causes the program to go into
      an error state and exit.

<div class="paragraph"> </div>


</li>
<li> If an <span class="inlinecode"><span class="id" type="var">ASSUME</span></span> statement fails, the program fails to evaluate
      at all. In other words, the program gets stuck and has no
      final state.

</li>
</ul>
    The new set of commands is: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Inductive</span> <span class="id" type="var">com</span> : <span class="id" type="keyword">Type</span> :=<br/>
&nbsp;&nbsp;| <span class="id" type="var">CSkip</span> : <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CAss</span> : <span class="id" type="var">string</span> → <span class="id" type="var">aexp</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CSeq</span> : <span class="id" type="var">com</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CIf</span> : <span class="id" type="var">bexp</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CWhile</span> : <span class="id" type="var">bexp</span> → <span class="id" type="var">com</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CAssert</span> : <span class="id" type="var">bexp</span> → <span class="id" type="var">com</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">CAssume</span> : <span class="id" type="var">bexp</span> → <span class="id" type="var">com</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Notation</span> "'SKIP'" :=<br/>
&nbsp;&nbsp;<span class="id" type="var">CSkip</span>.<br/>
<span class="id" type="keyword">Notation</span> "x '<span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span>' a" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CAss</span> <span class="id" type="var">x</span> <span class="id" type="var">a</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 60).<br/>
<span class="id" type="keyword">Notation</span> "c<sub>1</sub> ;; c<sub>2</sub>" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CSeq</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>).<br/>
<span class="id" type="keyword">Notation</span> "'WHILE' b 'DO' c 'END'" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CWhile</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>).<br/>
<span class="id" type="keyword">Notation</span> "'TEST' c<sub>1</sub> 'THEN' c<sub>2</sub> 'ELSE' c<sub>3</sub> 'FI'" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CIf</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">c<sub>3</sub></span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 80, <span class="id" type="var">right</span> <span class="id" type="var">associativity</span>).<br/>
<span class="id" type="keyword">Notation</span> "'ASSERT' b" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CAssert</span> <span class="id" type="var">b</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 60).<br/>
<span class="id" type="keyword">Notation</span> "'ASSUME' b" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">CAssume</span> <span class="id" type="var">b</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 60).<br/>
</div>

<div class="doc">
To define the behavior of <span class="inlinecode"><span class="id" type="var">ASSERT</span></span> and <span class="inlinecode"><span class="id" type="var">ASSUME</span></span>, we need to add
    notation for an error, which indicates that an assertion has
    failed. We modify the <span class="inlinecode"><span class="id" type="var">ceval</span></span> relation, therefore, so that
    it relates a start state to either an end state or to <span class="inlinecode"><span class="id" type="var">error</span></span>.
    The <span class="inlinecode"><span class="id" type="var">result</span></span> type indicates the end value of a program,
    either a state or an error: 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Inductive</span> <span class="id" type="var">result</span> : <span class="id" type="keyword">Type</span> :=<br/>
&nbsp;&nbsp;| <span class="id" type="var">RNormal</span> : <span class="id" type="var">state</span> → <span class="id" type="var">result</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">RError</span> : <span class="id" type="var">result</span>.<br/>
</div>

<div class="doc">
Now we are ready to give you the ceval relation for the new language. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Inductive</span> <span class="id" type="var">ceval</span> : <span class="id" type="var">com</span> → <span class="id" type="var">state</span> → <span class="id" type="var">result</span> → <span class="id" type="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;Old&nbsp;rules,&nbsp;several&nbsp;modified&nbsp;*)</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_Skip</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">SKIP</span> ]⇒ <span class="id" type="var">RNormal</span> <span class="id" type="var">st</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_Ass</span>  : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">a<sub>1</sub></span> <span class="id" type="var">n</span> <span class="id" type="var">x</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">aeval</span> <span class="id" type="var">st</span> <span class="id" type="var">a<sub>1</sub></span> = <span class="id" type="var">n</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">x</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">a<sub>1</sub></span> ]⇒ <span class="id" type="var">RNormal</span> (<span class="id" type="var">x</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> <span class="id" type="var">n</span> ; <span class="id" type="var">st</span>)<br/>
&nbsp;&nbsp;| <span class="id" type="var">E_SeqNormal</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">r</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span>  =[ <span class="id" type="var">c<sub>1</sub></span> ]⇒ <span class="id" type="var">RNormal</span> <span class="id" type="var">st'</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st'</span> =[ <span class="id" type="var">c<sub>2</sub></span> ]⇒ <span class="id" type="var">r</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span>  =[ <span class="id" type="var">c<sub>1</sub></span> ;; <span class="id" type="var">c<sub>2</sub></span> ]⇒ <span class="id" type="var">r</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_SeqError</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">st</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">c<sub>1</sub></span> ]⇒ <span class="id" type="var">RError</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">c<sub>1</sub></span> ;; <span class="id" type="var">c<sub>2</sub></span> ]⇒ <span class="id" type="var">RError</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_IfTrue</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">r</span> <span class="id" type="var">b</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">true</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">c<sub>1</sub></span> ]⇒ <span class="id" type="var">r</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">TEST</span> <span class="id" type="var">b</span> <span class="id" type="var">THEN</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">ELSE</span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">FI</span> ]⇒ <span class="id" type="var">r</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_IfFalse</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">r</span> <span class="id" type="var">b</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">false</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">c<sub>2</sub></span> ]⇒ <span class="id" type="var">r</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">TEST</span> <span class="id" type="var">b</span> <span class="id" type="var">THEN</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">ELSE</span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">FI</span> ]⇒ <span class="id" type="var">r</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_WhileFalse</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">b</span> <span class="id" type="var">st</span> <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">false</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span> ]⇒ <span class="id" type="var">RNormal</span> <span class="id" type="var">st</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_WhileTrueNormal</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">r</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">true</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span>  =[ <span class="id" type="var">c</span> ]⇒ <span class="id" type="var">RNormal</span> <span class="id" type="var">st'</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st'</span> =[ <span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span> ]⇒ <span class="id" type="var">r</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span>  =[ <span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span> ]⇒ <span class="id" type="var">r</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_WhileTrueError</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">true</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">c</span> ]⇒ <span class="id" type="var">RError</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span> ]⇒ <span class="id" type="var">RError</span><br/>
&nbsp;&nbsp;<span class="comment">(*&nbsp;Rules&nbsp;for&nbsp;Assert&nbsp;and&nbsp;Assume&nbsp;*)</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_AssertTrue</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">b</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">true</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">ASSERT</span> <span class="id" type="var">b</span> ]⇒ <span class="id" type="var">RNormal</span> <span class="id" type="var">st</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_AssertFalse</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">b</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">false</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">ASSERT</span> <span class="id" type="var">b</span> ]⇒ <span class="id" type="var">RError</span><br/>
&nbsp;&nbsp;| <span class="id" type="var">E_Assume</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">b</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">beval</span> <span class="id" type="var">st</span> <span class="id" type="var">b</span> = <span class="id" type="var">true</span> →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">ASSUME</span> <span class="id" type="var">b</span> ]⇒ <span class="id" type="var">RNormal</span> <span class="id" type="var">st</span><br/>
<br/>
<span class="id" type="keyword">where</span> "st '=[' c ']⇒' r" := (<span class="id" type="var">ceval</span> <span class="id" type="var">c</span> <span class="id" type="var">st</span> <span class="id" type="var">r</span>).<br/>
</div>

<div class="doc">
We redefine hoare triples: Now, <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>}</span> <span class="inlinecode"><span class="id" type="var">c</span></span> <span class="inlinecode"><span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}</span> means that,
    whenever <span class="inlinecode"><span class="id" type="var">c</span></span> is started in a state satisfying <span class="inlinecode"><span class="id" type="var">P</span></span>, and terminates
    with result <span class="inlinecode"><span class="id" type="var">r</span></span>, then <span class="inlinecode"><span class="id" type="var">r</span></span> is not an error and the state of <span class="inlinecode"><span class="id" type="var">r</span></span>
    satisfies <span class="inlinecode"><span class="id" type="var">Q</span></span>. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Definition</span> <span class="id" type="var">hoare_triple</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span class="id" type="var">P</span> : <span class="id" type="var">Assertion</span>) (<span class="id" type="var">c</span> : <span class="id" type="var">com</span>) (<span class="id" type="var">Q</span> : <span class="id" type="var">Assertion</span>) : <span class="id" type="keyword">Prop</span> :=<br/>
&nbsp;&nbsp;<span style='font-size:120%;'>&forall;</span><span class="id" type="var">st</span> <span class="id" type="var">r</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">st</span> =[ <span class="id" type="var">c</span> ]⇒ <span class="id" type="var">r</span>  → <span class="id" type="var">P</span> <span class="id" type="var">st</span>  →<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span style='font-size:120%;'>&exist;</span><span class="id" type="var">st'</span>, <span class="id" type="var">r</span> = <span class="id" type="var">RNormal</span> <span class="id" type="var">st'</span> ∧ <span class="id" type="var">Q</span> <span class="id" type="var">st'</span>).<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Notation</span> "<span style='letter-spacing:-.4em;'>{</span>{ P <span style='letter-spacing:-.4em;'>}</span>}  c  <span style='letter-spacing:-.4em;'>{</span>{ Q <span style='letter-spacing:-.4em;'>}</span>}" :=<br/>
&nbsp;&nbsp;(<span class="id" type="var">hoare_triple</span> <span class="id" type="var">P</span> <span class="id" type="var">c</span> <span class="id" type="var">Q</span>) (<span class="id" type="tactic">at</span> <span class="id" type="var">level</span> 90, <span class="id" type="var">c</span> <span class="id" type="tactic">at</span> <span class="id" type="var">next</span> <span class="id" type="var">level</span>)<br/>
&nbsp;&nbsp;: <span class="id" type="var">hoare_spec_scope</span>.<br/>
</div>

<div class="doc">
To test your understanding of this modification, give an example
    precondition and postcondition that are satisfied by the <span class="inlinecode"><span class="id" type="var">ASSUME</span></span>
    statement but not by the <span class="inlinecode"><span class="id" type="var">ASSERT</span></span> statement.  Then prove that any
    triple for <span class="inlinecode"><span class="id" type="var">ASSERT</span></span> also works for <span class="inlinecode"><span class="id" type="var">ASSUME</span></span>. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">assert_assume_differ</span> : <span style='font-size:120%;'>&exist;</span><span class="id" type="var">P</span> <span class="id" type="var">b</span> <span class="id" type="var">Q</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">ASSUME</span> <span class="id" type="var">b</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>})<br/>
&nbsp;&nbsp;∧ ¬(<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">ASSERT</span> <span class="id" type="var">b</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}).<br/>
<span class="id" type="keyword">Proof</span>.<br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">assert_implies_assume</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">P</span> <span class="id" type="var">b</span> <span class="id" type="var">Q</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">ASSERT</span> <span class="id" type="var">b</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>})<br/>
&nbsp;&nbsp;→ (<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">ASSUME</span> <span class="id" type="var">b</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}).<br/>
<span class="id" type="keyword">Proof</span>.<br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/>
</div>

<div class="doc">
Your task is now to state Hoare rules for <span class="inlinecode"><span class="id" type="var">ASSERT</span></span> and <span class="inlinecode"><span class="id" type="var">ASSUME</span></span>,
    and use them to prove a simple program correct.  Name your hoare
    rule theorems <span class="inlinecode"><span class="id" type="var">hoare_assert</span></span> and <span class="inlinecode"><span class="id" type="var">hoare_assume</span></span>.

<div class="paragraph"> </div>

    For your benefit, we provide proofs for the old hoare rules
    adapted to the new semantics. 
</div>
<div class="code code-tight">

<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_asgn</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">Q</span> <span class="id" type="var">X</span> <span class="id" type="var">a</span>,<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span> [<span class="id" type="var">X</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>&#x22A2;</span><span style='font-size:90%;'>&gt;</span></span></span></span> <span class="id" type="var">a</span>]<span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">a</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">hoare_triple</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">Q</span> <span class="id" type="var">X</span> <span class="id" type="var">a</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">HE</span> <span class="id" type="var">HQ</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">inversion</span> <span class="id" type="var">HE</span>. <span class="id" type="tactic">subst</span>.<br/>
&nbsp;&nbsp;<span style='font-size:120%;'>&exist;</span>(<span class="id" type="var">X</span> !<span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span>&gt;</span></span> <span class="id" type="var">aeval</span> <span class="id" type="var">st</span> <span class="id" type="var">a</span> ; <span class="id" type="var">st</span>). <span class="id" type="tactic">split</span>; <span class="id" type="tactic">try</span> <span class="id" type="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">assumption</span>. <span class="id" type="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_consequence_pre</span> : <span style='font-size:120%;'>&forall;</span>(<span class="id" type="var">P</span> <span class="id" type="var">P'</span> <span class="id" type="var">Q</span> : <span class="id" type="var">Assertion</span>) <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P'</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;<span class="id" type="var">P</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">P'</span> →<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">P'</span> <span class="id" type="var">Q</span> <span class="id" type="var">c</span> <span class="id" type="var">Hhoare</span> <span class="id" type="var">Himp</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">Hc</span> <span class="id" type="var">HP</span>. <span class="id" type="tactic">apply</span> (<span class="id" type="var">Hhoare</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span>).<br/>
&nbsp;&nbsp;<span class="id" type="tactic">assumption</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">Himp</span>. <span class="id" type="tactic">assumption</span>. <span class="id" type="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_consequence_post</span> : <span style='font-size:120%;'>&forall;</span>(<span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">Q'</span> : <span class="id" type="var">Assertion</span>) <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q'</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;<span class="id" type="var">Q'</span> <span class="nowrap"><span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>-</span></span><span style='letter-spacing:-.2em;'>></span>></span></span> <span class="id" type="var">Q</span> →<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">Q'</span> <span class="id" type="var">c</span> <span class="id" type="var">Hhoare</span> <span class="id" type="var">Himp</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">st</span> <span class="id" type="var">r</span> <span class="id" type="var">Hc</span> <span class="id" type="var">HP</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">hoare_triple</span> <span class="id" type="keyword">in</span> <span class="id" type="var">Hhoare</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">assert</span> (<span style='font-size:120%;'>&exist;</span><span class="id" type="var">st'</span>, <span class="id" type="var">r</span> = <span class="id" type="var">RNormal</span> <span class="id" type="var">st'</span> ∧ <span class="id" type="var">Q'</span> <span class="id" type="var">st'</span>).<br/>
&nbsp;&nbsp;{ <span class="id" type="tactic">apply</span> (<span class="id" type="var">Hhoare</span> <span class="id" type="var">st</span>); <span class="id" type="tactic">assumption</span>. }<br/>
&nbsp;&nbsp;<span class="id" type="tactic">destruct</span> <span class="id" type="var">H</span> <span class="id" type="keyword">as</span> [<span class="id" type="var">st'</span> [<span class="id" type="var">Hr</span> <span class="id" type="var">HQ'</span>]].<br/>
&nbsp;&nbsp;<span style='font-size:120%;'>&exist;</span><span class="id" type="var">st'</span>. <span class="id" type="tactic">split</span>; <span class="id" type="tactic">try</span> <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">Himp</span>. <span class="id" type="tactic">assumption</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_seq</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">R</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span>,<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c<sub>2</sub></span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">R</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c<sub>1</sub></span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c<sub>1</sub></span>;;<span class="id" type="var">c<sub>2</sub></span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">R</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">R</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">H<sub>1</sub></span> <span class="id" type="var">H<sub>2</sub></span> <span class="id" type="var">st</span> <span class="id" type="var">r</span> <span class="id" type="var">H<sub>12</sub></span> <span class="id" type="var">Pre</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">inversion</span> <span class="id" type="var">H<sub>12</sub></span>; <span class="id" type="tactic">subst</span>.<br/>
&nbsp;&nbsp;- <span class="id" type="tactic">eapply</span> <span class="id" type="var">H<sub>1</sub></span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" type="tactic">apply</span> <span class="id" type="var">H<sub>6</sub></span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" type="tactic">apply</span> <span class="id" type="var">H<sub>2</sub></span> <span class="id" type="keyword">in</span> <span class="id" type="var">H<sub>3</sub></span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">H<sub>3</sub></span> <span class="id" type="keyword">in</span> <span class="id" type="var">Pre</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">destruct</span> <span class="id" type="var">Pre</span> <span class="id" type="keyword">as</span> [<span class="id" type="var">st'0</span> [<span class="id" type="var">Heq</span> <span class="id" type="var">HQ</span>]].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">inversion</span> <span class="id" type="var">Heq</span>; <span class="id" type="tactic">subst</span>. <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;Find&nbsp;contradictory&nbsp;assumption&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">H<sub>2</sub></span> <span class="id" type="keyword">in</span> <span class="id" type="var">H<sub>5</sub></span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">H<sub>5</sub></span> <span class="id" type="keyword">in</span> <span class="id" type="var">Pre</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">destruct</span> <span class="id" type="var">Pre</span> <span class="id" type="keyword">as</span> [<span class="id" type="var">st'</span> [<span class="id" type="var">C</span> <span class="id" type="var">_</span>]].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">inversion</span> <span class="id" type="var">C</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/>
</div>

<div class="doc">
State and prove your hoare rules, <span class="inlinecode"><span class="id" type="var">hoare_assert</span></span> and
    <span class="inlinecode"><span class="id" type="var">hoare_assume</span></span>, below. 
</div>
<div class="code code-tight">

<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span><br/>
</div>

<div class="doc">
Here are the other proof rules (sanity check) 
</div>
<div class="code code-tight">
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_skip</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">P</span>,<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">SKIP</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">H</span> <span class="id" type="var">HP</span>. <span class="id" type="tactic">inversion</span> <span class="id" type="var">H</span>. <span class="id" type="tactic">subst</span>.<br/>
&nbsp;&nbsp;<span class="id" type="var">eexists</span>. <span class="id" type="tactic">split</span>. <span class="id" type="tactic">reflexivity</span>. <span class="id" type="tactic">assumption</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_if</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">b</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span>,<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">P</span> <span class="id" type="var">st</span> ∧ <span class="id" type="var">bassn</span> <span class="id" type="var">b</span> <span class="id" type="var">st</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c<sub>1</sub></span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">P</span> <span class="id" type="var">st</span> ∧ ¬(<span class="id" type="var">bassn</span> <span class="id" type="var">b</span> <span class="id" type="var">st</span>)<span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c<sub>2</sub></span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">TEST</span> <span class="id" type="var">b</span> <span class="id" type="var">THEN</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">ELSE</span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">FI</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">Q</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">Q</span> <span class="id" type="var">b</span> <span class="id" type="var">c<sub>1</sub></span> <span class="id" type="var">c<sub>2</sub></span> <span class="id" type="var">HTrue</span> <span class="id" type="var">HFalse</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">HE</span> <span class="id" type="var">HP</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">inversion</span> <span class="id" type="var">HE</span>; <span class="id" type="tactic">subst</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;b&nbsp;is&nbsp;true&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> (<span class="id" type="var">HTrue</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span>).<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">split</span>. <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">bexp_eval_true</span>. <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;b&nbsp;is&nbsp;false&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> (<span class="id" type="var">HFalse</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span>).<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">split</span>. <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">bexp_eval_false</span>. <span class="id" type="tactic">assumption</span>. <span class="id" type="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Theorem</span> <span class="id" type="var">hoare_while</span> : <span style='font-size:120%;'>&forall;</span><span class="id" type="var">P</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span>,<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">P</span> <span class="id" type="var">st</span> ∧ <span class="id" type="var">bassn</span> <span class="id" type="var">b</span> <span class="id" type="var">st</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">c</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} →<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="var">P</span><span style='letter-spacing:-.4em;'>}</span>} <span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span> <span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">P</span> <span class="id" type="var">st</span> ∧ ¬(<span class="id" type="var">bassn</span> <span class="id" type="var">b</span> <span class="id" type="var">st</span>)<span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">intros</span> <span class="id" type="var">P</span> <span class="id" type="var">b</span> <span class="id" type="var">c</span> <span class="id" type="var">Hhoare</span> <span class="id" type="var">st</span> <span class="id" type="var">st'</span> <span class="id" type="var">He</span> <span class="id" type="var">HP</span>.<br/>
&nbsp;&nbsp;<span class="id" type="var">remember</span> (<span class="id" type="var">WHILE</span> <span class="id" type="var">b</span> <span class="id" type="var">DO</span> <span class="id" type="var">c</span> <span class="id" type="var">END</span>) <span class="id" type="keyword">as</span> <span class="id" type="var">wcom</span> <span class="id" type="var">eqn</span>:<span class="id" type="var">Heqwcom</span>.<br/>
&nbsp;&nbsp;<span class="id" type="tactic">induction</span> <span class="id" type="var">He</span>;<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">try</span> (<span class="id" type="tactic">inversion</span> <span class="id" type="var">Heqwcom</span>); <span class="id" type="tactic">subst</span>; <span class="id" type="tactic">clear</span> <span class="id" type="var">Heqwcom</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;E_WhileFalse&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">eexists</span>. <span class="id" type="tactic">split</span>. <span class="id" type="tactic">reflexivity</span>. <span class="id" type="tactic">split</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">assumption</span>. <span class="id" type="tactic">apply</span> <span class="id" type="var">bexp_eval_false</span>. <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;E_WhileTrueNormal&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">clear</span> <span class="id" type="var">IHHe1</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">IHHe2</span>. <span class="id" type="tactic">reflexivity</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">clear</span> <span class="id" type="var">IHHe2</span> <span class="id" type="var">He<sub>2</sub></span> <span class="id" type="var">r</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">hoare_triple</span> <span class="id" type="keyword">in</span> <span class="id" type="var">Hhoare</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">Hhoare</span> <span class="id" type="keyword">in</span> <span class="id" type="var">He<sub>1</sub></span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" type="tactic">destruct</span> <span class="id" type="var">He<sub>1</sub></span> <span class="id" type="keyword">as</span> [<span class="id" type="var">st<sub>1</sub></span> [<span class="id" type="var">Heq</span> <span class="id" type="var">Hst1</span>]].<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">inversion</span> <span class="id" type="var">Heq</span>; <span class="id" type="tactic">subst</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" type="tactic">split</span>; <span class="id" type="tactic">assumption</span>.<br/>
&nbsp;&nbsp;- <span class="comment">(*&nbsp;E_WhileTrueError&nbsp;*)</span><br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="var">exfalso</span>. <span class="id" type="tactic">clear</span> <span class="id" type="var">IHHe</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">unfold</span> <span class="id" type="var">hoare_triple</span> <span class="id" type="keyword">in</span> <span class="id" type="var">Hhoare</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="id" type="tactic">apply</span> <span class="id" type="var">Hhoare</span> <span class="id" type="keyword">in</span> <span class="id" type="var">He</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" type="tactic">destruct</span> <span class="id" type="var">He</span> <span class="id" type="keyword">as</span> [<span class="id" type="var">st'</span> [<span class="id" type="var">C</span> <span class="id" type="var">_</span>]]. <span class="id" type="tactic">inversion</span> <span class="id" type="var">C</span>.<br/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+ <span class="id" type="tactic">split</span>; <span class="id" type="tactic">assumption</span>.<br/>
<span class="id" type="keyword">Qed</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">Example</span> <span class="id" type="var">assert_assume_example</span>:<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}<br/>
&nbsp;&nbsp;<span class="id" type="var">ASSUME</span> (<span class="id" type="var">X</span> = 1);;<br/>
&nbsp;&nbsp;<span class="id" type="var">X</span> <span style='font-size:85%;'><span style='vertical-align:5%;'><span style='letter-spacing:-.2em;'>:</span>:</span>=</span> <span class="id" type="var">X</span> + 1;;<br/>
&nbsp;&nbsp;<span class="id" type="var">ASSERT</span> (<span class="id" type="var">X</span> = 2)<br/>
&nbsp;&nbsp;<span style='letter-spacing:-.4em;'>{</span>{<span class="id" type="keyword">fun</span> <span class="id" type="var">st</span> ⇒ <span class="id" type="var">True</span><span style='letter-spacing:-.4em;'>}</span>}.<br/>
<span class="id" type="keyword">Proof</span>.<br/>
<span class="comment">(*&nbsp;FILL&nbsp;IN&nbsp;HERE&nbsp;*)</span> <span class="id" type="var">Admitted</span>.<br/><hr class='doublespaceincode'/>
<span class="id" type="keyword">End</span> <span class="id" type="var">HoareAssertAssume</span>.<br/>
</div>

<span class="proofbox">&#9744;</span> 
<div class="code code-tight">

<span class="comment">(*&nbsp;Thu&nbsp;Feb&nbsp;7&nbsp;20:09:23&nbsp;EST&nbsp;2019&nbsp;*)</span><br/>
</div>
</div>



</div>

</body>
</html>